htmlspecialchars

[UnknownPlayer]

Hi,

should i use htmlspecialchars() when i write in mysql or when i read from mysql, and should i use another function for safety ?

 

[AyKay47]

typically using both mysql_real_escape_string and htmlentities is a good way of sanitizing user input before inserting it into a database

[AbraCadaver]

Don't use htmlentities() to insert.  Use it when you want to display data but don't want HTML.  If you want to store legitimate HTML then store it as is.  There is no concern with storing HTML, the concern is when you display it in a browser.  If you don't want HTML then either reject it and don't insert it or striptags().

[AyKay47]

Don't use htmlentities() to insert.  Use it when you want to display data but don't want HTML.  If you want to store legitimate HTML then store it as is.  There is no concern with storing HTML, the concern is when you display it in a browser.  If you don't want HTML then either reject it and don't insert it or striptags().

sorry, my answer was unclear, escape data to be inserted, use htmlentities to output.. however it would still be acceptable to use htmlentities before database insertion.. just wouldn't be as clean/organized.

[UnknownPlayer]

I will use that 2 functions on every field, but i need to know when i need to use htmlspecialchars ?

And how do u mean to use htmpentities only when not HTML ? If u can explain me pls ?

And thanks..

[UnknownPlayer]

Do you mean when i wonna put something from db to input field or div to use htmlentities, only when read from db ?

I should use that function always when echo data?

[AbraCadaver]

htmlspecialchars() is similar to htmlentities() except that it only translates 5 characters.  You don't need it if you use htmlentities().  And as I said before, you shouldn't use it on data going to the database.  Use it when displaying if you don't want the data rendered as HTML.  If the data should not contain HTML then use striptags() before insert.

[UnknownPlayer]

Ok, i know now, thanks..

[UnknownPlayer]

Now i got problem with latin chars žšđčć, example: š is in browser Å¡.

How can i fix that? Without htmlentities, it works fine..

[mikesta707]

HTML entities has an optional charset argument (the 3rd argument) which you can use to specify a charset for the function to use in its conversion. It seems to me you have a charset problem, so check out the manual entry on htmlentities: http://php.net/manual/en/function.htmlentities.php

 

and look at the examples which specify a charset, and look at the charsets that PHP supports. I am not very knowledgeable on what characters are in what charsets, so this is just a guess, but ISO-8859-15 may be what you need

[UnknownPlayer]

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

And in db is utf8_general_ci..

[xyph]

Did you not read his post? You need to specify the charset when you call htmlentities

 

Better yet - don't use htmlentities(). Characters like 'žšđčć' don't need to be encoded assuming you've declared the page is UTF-8 in the META and your database uses UTF-8. Instead, use htmlspecialchars. It's safe by default to use with most common encodings.

 

Calling htmlspecialchars() on data you grab from the database ensures that someone hasn't put rouge data into your database, and avoided any checks you put in while inserting.

[UnknownPlayer]

I can use strip_tags and mysql_real_escape_string for inserting, and for output i dont need to use any function ? It will be safe ?

[xyph]

I would not suggest using strip_tags, as you are leaving yourself open to any future vulnerabilities found in that function.

 

If you must have formatting, use BBCode. There's tons of support for it.

 

I suggest using XSS-prevention methods when you echo your data. If you do it on insertion, and someone finds a way to inject data that bypasses that insertion call, you will be open to XSS. Instead, perform the htmlspecialchars() or strip_tags() call when you want to output the data.

[UnknownPlayer]

So, what would u suggest me with  these fields:

- name of article

- description (tinymce)

- date(numbers)

- phone number

this can insert any registred user..

 

What should i use for insert, select and output on page ?

[xyph]

insert - mysqli_escape_string

select - nothing needed

output - htmlspecialchars

[UnknownPlayer]

Thanks..