PHP Adding/Editing DB via FORMS - Irish SEO, Marketing & Webmaster Discussion

ziycon · #1 (**permalink**) 20-03-2008, 02:32 AM

The situation is, im using a normal HTML in a PHP page, the problem is when i add text to the textarea and submit it to the DB and when i query it to show up on the next page the <br>(these tags are entered manually into the textarea before submitting) show up in the text and the   characters show up also anything after a double quote is not stored into the DB, the field is defined as a text type!
Any help would be much appreciated as always.

Frodo · #2 (**permalink**) 20-03-2008, 02:53 AM

are you using mysql_escape_string()?

ziycon · #3 (**permalink**) 20-03-2008, 03:01 AM

Quote:

Originally Posted by Frodo

are you using mysql_escape_string()?

Not that im aware of, what exactly does it do, tried to make sense of it but couldn't!?

Frodo · #4 (**permalink**) 20-03-2008, 03:20 AM

Quote:

Originally Posted by ziycon

Not that im aware of, what exactly does it do, tried to make sense of it but couldn't!?

It escapes nasty charters in you sql statements. It's essential to stop mysql injection attacks.

Your insert code should look like this:

PHP Code:

  $content = $_POST['content'];
$dbcontent = mysql_escape_string($content);
$sql="insert into some_table(msContent) values ('".$dbcontent."')";
$result = mysql_query($sql,$conn) or die("Fail");

ziycon · #5 (**permalink**) 20-03-2008, 03:33 AM

Quote:

Originally Posted by Frodo

It escapes nasty charters in you sql statements. It's essential to stop mysql injection attacks.

Your insert code should look like this:

PHP Code:

  $content = $_POST['content'];
$dbcontent = mysql_escape_string($content);
$sql="insert into some_table(msContent) values ('".$dbcontent."')";
$result = mysql_query($sql,$conn) or die("Fail");

No need to worry abouy sql injection attacks on the pages in questions, there secure enough already, so if i have something like so it should work?

PHP Code:

  <?php
header("Location: ../news/1.htm");
include('../forum/SSI.php');

dbConnect();

global $context;

if($context['user']['is_logged'])
{
    $validate_admin = check_admin_userid($context['user']['id']);
    $validate = check_sec_admin_userid($context['user']['id'],2);
    if(($validate == true) || ($validate_admin == true))
    {
        $content = mysql_escape_string($_REQUEST['body']);        
        mysql_query("UPDATE news SET title='".$_GET['title']."', body='".$content."'  WHERE id=".$_GET['id']."");
    }
}

closeConnect();
?>

Tired this but the stripslashes function is not working when displaying the text now!?

Forbairt · #6 (**permalink**) 20-03-2008, 08:39 AM

Quote:

Originally Posted by ziycon

No need to worry abouy sql injection attacks on the pages in questions, there secure enough already, so if i have something like so it should work?

Famous last words

ziycon · #7 (**permalink**) 20-03-2008, 11:43 AM

Quote:

Originally Posted by Forbairt

Famous last words

They should be fine, you have to be logged in and have admin right then to even view the pages!

I read something about putting '<br>' tags into textareas and then not being the right encoding type but i have the same thing setup on another site and it will accept these tags and double quotes etc no problem, cant seen to figure it out!?

Frodo · #8 (**permalink**) 20-03-2008, 01:55 PM

You shouldn't need the stripslashes function or the addslashes function when you are using mysql_escape_string function.

ziycon · #9 (**permalink**) 20-03-2008, 05:14 PM

Quote:

Originally Posted by Frodo

You shouldn't need the stripslashes function or the addslashes function when you are using mysql_escape_string function.

Ok, i'll have a look at it when i get home, thanks.

ziycon · #10 (**permalink**) 20-03-2008, 11:31 PM

Ok, still not working, if i add data directly to the DB is shows up fine but if i add it via a webpage or edit it via a webpage either slashes start showing up, everything after double quotes disappears or the html tags are converted from '<br> to '<br>'!
I'm not understanding this mysql_escape_string function, wheres it ment to go, before data enters the db or after or what does it even do, tried php.net but sometimes they word things difficult enough!?

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Ruby on Rails VS PHP Code Igniter	gav240z	Coding Help	10	03-02-2008 11:04 PM
PHP Wierdness	elspudo	Coding Help	3	18-12-2007 07:49 PM
form sending without php	Joseph Grogan	Coding Help	5	05-09-2007 01:32 PM
PHP, OOPS! data typing	Mike	Coding Help	2	24-08-2007 02:44 PM
WTF - Some PHP Obfuscation.	daviddoran	General Chat	8	20-02-2007 04:45 PM