mysql_real_esca pe_string() chopping off after quotes

[Paul Furman]

mysql_real_esca pe_string() is apparently chopping off anything that
follows a quote when I grab the data & put it in a form for editing.
Sorry if I'm not explaining this properly, I'm pretty confused about
what's going on but I'm guessing someone recognizes this problem.

I have code like this:

function db_safe($str) {
$str = addslashes($str );
return $str;
}

function html_safe($str) {
$str = stripslashes($s tr);
return $str;
}

That's on my live server, I'm not sure if magic quotes is on there or I
forgot to update because my test server version look like:

function db_safe($str) {
// $str = addslashes($str );
$str = mysql_real_esca pe_string($str) ;
Anyways then there's code like this:

if (isset($_REQUES T["submit"])) {
$latin_name = html_safe($_REQ UEST["latin_name "]);
if ((isset($_REQUE ST["option"])) && ($_REQUEST["option"] == "update")) {
$id = $_REQUEST["id"];
$latin_name=db_ safe($latin_nam e);
and this is where it's chopping off text after the quote:
<form action=.......
<input type='text' size='57' name='latin_nam e' value="<?=$lati n_name?>">

[Paul Furman]

Paul Furman wrote:

mysql_real_esca pe_string() is apparently chopping off anything that
follows a quote when I grab the data & put it in a form for editing.
Sorry if I'm not explaining this properly, I'm pretty confused about
what's going on but I'm guessing someone recognizes this problem.

It's only chopping off for one of the fields with a single quote. Double
quote are OK. I don't see where I'm doing anything different with the
two fields.

I have code like this:

function db_safe($str) {
$str = addslashes($str );
return $str;
}

function html_safe($str) {
$str = stripslashes($s tr);
return $str;
}

That's on my live server, I'm not sure if magic quotes is on there or I
forgot to update because my test server version look like:

function db_safe($str) {
// $str = addslashes($str );
$str = mysql_real_esca pe_string($str) ;
Anyways then there's code like this:

if (isset($_REQUES T["submit"])) {
$latin_name = html_safe($_REQ UEST["latin_name "]);
if ((isset($_REQUE ST["option"])) && ($_REQUEST["option"] ==
"update")) {
$id = $_REQUEST["id"];
$latin_name=db_ safe($latin_nam e);
and this is where it's chopping off text after the quote:
<form action=.......
<input type='text' size='57' name='latin_nam e' value="<?=$lati n_name?>">

--
Paul Furman Photography
http://edgehill.net
Bay Natives Nursery
http://www.baynatives.com

[Michael Fesser]

..oO(Paul Furman)

>mysql_real_esc ape_string() is apparently chopping off anything that
follows a quote when I grab the data & put it in a form for editing.

It doesn't chop off anything, it's a bug in your output code.

>and this is where it's chopping off text after the quote:

<form action=.......
<input type='text' size='57' name='latin_nam e' value="<?=$lati n_name?>">

Two things:

* Don't rely on short open tags, use <?php echo ...?instead.

* Have a look at the generated HTML source code - it's all there, just
improperly escaped. When printing anything to an HTML page, use
htmlspecialchar s() to escape those characters that have a special
meaning in HTML (", &, <, >). If necessary use the ENT_QUOTES flag. See
the manual for details.

http://www.php.net/htmlspecialchars

Micha

[Paul Furman]

Michael Fesser wrote:

.oO(Paul Furman)

>>mysql_real_es cape_string() is apparently chopping off anything that
follows a quote when I grab the data & put it in a form for editing.

It doesn't chop off anything, it's a bug in your output code.

>>and this is where it's chopping off text after the quote:

<form action=.......
<input type='text' size='57' name='latin_nam e' value="<?=$lati n_name?>">

Ah, thank you!!

The bad field was using single quotes:
value='<?=$comm on_name?>'>

The good field had double quotes:
value="<?=$comm on_name?>">

Two things:

* Don't rely on short open tags, use <?php echo ...?instead.

Yes, thanks, my code is quite a mess, partly due to collaboration. I
wondered why some were done in that fashion, now I know it's not good
practice.

* Have a look at the generated HTML source code - it's all there, just
improperly escaped. When printing anything to an HTML page, use
htmlspecialchar s() to escape those characters that have a special
meaning in HTML (", &, <, >). If necessary use the ENT_QUOTES flag. See
the manual for details.

http://www.php.net/htmlspecialchars

Thanks again, it sounds like I should run that in my html_safe()
function along with stripslashes().
--
Paul Furman Photography
http://edgehill.net
Bay Natives Nursery
http://www.baynatives.com

[Paul Furman]

Paul Furman wrote:

Michael Fesser wrote:

>When printing anything to an HTML page, use
htmlspecialcha rs() to escape those characters that have a special
meaning in HTML (", &, <, >). If necessary use the ENT_QUOTES flag. See
the manual for details.

http://www.php.net/htmlspecialchars

Thanks again, it sounds like I should run that in my html_safe()
function along with stripslashes().

Just a followup on the htmlspecialchar s idea, I tried it & had to
disable it... if I used that, I'd need to be more selective than my
html_safe function because it disabled my ability to add content from
the admin interface with links & images. But thanks for mentioning it.

--
Paul Furman Photography
http://edgehill.net
Bay Natives Nursery
http://www.baynatives.com

[Jerry Stuckle]

Paul Furman wrote:

Paul Furman wrote:

>Michael Fesser wrote:

>>When printing anything to an HTML page, use
htmlspecialch ars() to escape those characters that have a special
meaning in HTML (", &, <, >). If necessary use the ENT_QUOTES flag. See
the manual for details.

http://www.php.net/htmlspecialchars

Thanks again, it sounds like I should run that in my html_safe()
function along with stripslashes().

Just a followup on the htmlspecialchar s idea, I tried it & had to
disable it... if I used that, I'd need to be more selective than my
html_safe function because it disabled my ability to add content from
the admin interface with links & images. But thanks for mentioning it.

If it's affecting links and images, you aren't being selective enough!

Like any other function - call it if you need to. But it's not meant to
be called for everything you're displaying.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Paul Furman]

Jerry Stuckle wrote:

Paul Furman wrote:

>Paul Furman wrote:

>>Michael Fesser wrote:

When printing anything to an HTML page, use
htmlspecialc hars() to escape those characters that have a special
meaning in HTML (", &, <, >). If necessary use the ENT_QUOTES flag. See
the manual for details.

http://www.php.net/htmlspecialchars

Thanks again, it sounds like I should run that in my html_safe()
function along with stripslashes().

Just a followup on the htmlspecialchar s idea, I tried it & had to
disable it... if I used that, I'd need to be more selective than my
html_safe function because it disabled my ability to add content from
the admin interface with links & images. But thanks for mentioning it.

If it's affecting links and images, you aren't being selective enough!

Like any other function - call it if you need to. But it's not meant to
be called for everything you're displaying.

Yes, agreed. My html_safe() function is being applied to anything that
leaves the mySQL database and anything entering gets the db_safe()
function applied. I don't really know why I'd need it except as a
catch-all at this point but good to know it exists if I encounter these
problems again and another handy way to display html code without being
interpreted by the browser.

--
Paul Furman Photography
http://edgehill.net
Bay Natives Nursery
http://www.baynatives.com

[Jerry Stuckle]

Paul Furman wrote:

Jerry Stuckle wrote:

>Paul Furman wrote:

>>Paul Furman wrote:
Michael Fesser wrote:

When printing anything to an HTML page, use
htmlspecial chars() to escape those characters that have a special
meaning in HTML (", &, <, >). If necessary use the ENT_QUOTES flag.
See
the manual for details.
>
http://www.php.net/htmlspecialchars

Thanks again, it sounds like I should run that in my html_safe()
function along with stripslashes().

Just a followup on the htmlspecialchar s idea, I tried it & had to
disable it... if I used that, I'd need to be more selective than my
html_safe function because it disabled my ability to add content from
the admin interface with links & images. But thanks for mentioning it.

If it's affecting links and images, you aren't being selective enough!

Like any other function - call it if you need to. But it's not meant
to be called for everything you're displaying.

Yes, agreed. My html_safe() function is being applied to anything that
leaves the mySQL database and anything entering gets the db_safe()
function applied. I don't really know why I'd need it except as a
catch-all at this point but good to know it exists if I encounter these
problems again and another handy way to display html code without being
interpreted by the browser.

Yep, but I just call mysql_real_esca pe_string() on the data as it is
being inserted into the database, i.e.

$result = mysql_query('IN SERT INTO mytable VALUES (' .
mysql_real_esca pe_string($val) . ')');

Or if I'm going to display the data:

echo htmlspecialchar s($val);

I don't change the variable itself. I might need it in it's "pure form"
again.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===