Need help with user input and displaying on a page

[cdoyle]

Hi,

 

I thought I had this right, but now I'm not sure.

 

I'm using ADODB for our game, and I created a page where users can load a signature to display on their profile.

So here is how we insert the sig into the db

 

 $addsig = $db->execute("UPDATE `players` SET `signature`=? WHERE `id`=?", array($sig, $player->id));

 

and this is how I display it on the page

 

  echo stripslashes(htmlentities($profile['signature'], ENT_QUOTES ));

 

I thought this would remove the harmful stuff people could put in their sigs, but today I noticed someone put a URL in their sig and the slashes were still there.  Shouldn't they have been removed?

 

What is the proper way to get input from users and to display it.

[flyhoney]

If you are paramaterizing your queries (as you should) and ADODB automatically escapes  paramterized queries, then I would make sure you have magic quotes disabled.  This way you never have to call any of the stripslashes() bullshit.  Then, when displaying the signature, you can use htmlentities().

[mikesta707]

html entities will make sure that any html code that anyone puts there won't get executed, so you should be ok. I don't see how slashes would be bad if nothing is being executed so maybe put an example of what "bad" is being shown on the page

[cdoyle]

Well I guess it's not really bad, but what happened was they put in an URL

for example http://www.something/here/andmore/you/get/theidea

 

and it stretched out the table cell it's displayed in.  but I guess even if I removed the slashes it would still do that anyways. 

 

so overall what I did looks OK?  and if I read the responses right,  I don't even need the stripslashes?

[Psycho]

  echo stripslashes(htmlentities($profile['signature'], ENT_QUOTES ));

 

I thought this would remove the harmful stuff people could put in their sigs, but today I noticed someone put a URL in their sig and the slashes were still there.  Shouldn't they have been removed?

 

As flyhoney stated htmlenteties() should be sufficient.

 

But, to answer your question...

 

stripslashes() removes backslashes - e.g. "\". A URL uses forward slashes (e.g. "/") and would not be affected by the stripslashes() function.

 

RTFM