A

Anonymous

Question

Confusion with html entities

Forum|Forum|13 years ago
November 6, 2012
1 reply
7182 views

I am POSTING a form to the same page, validating and sanitizing the input then re displaying the page, with preserved user input, if there are any user errors such as missing form items or incorrect formats.

When an error is detected and the page re displays I use :

value="<?php if (isset($_POST['textfield'])) {echo htmlentities($_POST['textfield']);

and

value="<?php if (isset($_POST['textarea'])) {echo htmlentities($_POST['textarea']);

to re display the user input.

My problem occurs when I use single or double quotes in the form, the display shows the equivalent " or ' instead of preserving the quotes from user input.

Perhaps this is correct, it makes sense, but I thought I was doing the right thing by using html entities to redisplay user input? I presume I am not using it correctly or missing something?

I would appreciate any help and advise with this problem

Thank you in advance.

Server side applications

This topic has been closed for replies.

Rob Hecker2

Legend

It sounds like you are using the deprecated MySQL connection.

NO ONE SHOULD BE USING THAT ANY LONGER!

Use PDO or MySQLi with prepared statements and parameterized queries to avoid SQL injection attacks.

Then you don't have to concern yourself with quotation marks in the data. Of course you must still validate and sanitize, but you don't need to convert the quotes/appostrophes, and no htmlentities needed.

A

Anonymous

Hi

Thank you for your reply, now I am really confused!

Ok its a while since I did the programming side of my website as I have spent the last 18 months doing the content.

I link to my database using:

require_once('connections/conndelete.php');

require_once('connections/connsearch.php');

require_once('connections/connadd.php');

require_once('connections/connupdate.php');

// with the connections details in the connections file

if (!function_exists("GetSQLValueString")) {

function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")

{

$theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

$theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

switch ($theType) {

case "text":

$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";

break;

case "long":

case "int":

$theValue = ($theValue != "") ? intval($theValue) : "NULL";

break;

case "double":

$theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";

break;

case "date":

$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";

break;

case "defined":

$theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;

break;

}

return $theValue;

}

mysql_select_db($database_connsearch, $connsearch);

$query_reMenuBeds = "SELECT * FROM bedtable";

$reMenuBeds = @ mysql_query($query_reMenuBeds, $connsearch);

$row_reMenuBeds = mysql_fetch_assoc($reMenuBeds);

$totalRows_reMenuBeds = mysql_num_rows($reMenuBeds);

Is the above the depreciated code?

Please could you point me in the direction of some information on the best way to amend my code to the prepared statements and parametrized queries that you mention.

Will I still be able to pull the information from my MySQL database?

This has thrown my completely as I though I was almost ready to go online so please could you point me in the right directions to changing my code with the least changes as in PDO or MysQLi which is the nearest to what I have been doing?

Hope you can help me,

I look forward to your reply,

Thank you in advance

Date: Tue, 6 Nov 2012 15:14:30 -0700

From: forums_noreply@adobe.com

To: linda.barker7@hotmail.com

Subject: Confusion with html entities

Re: Confusion with html entities

created by Rob Hecker2 in Developing server-side applications in Dreamweaver - View the full discussion

It sounds like you are using the deprecated MySQL connection. NO ONE SHOULD BE USING THAT ANY LONGER! Use PDO or MySQLi with prepared statements and parameterized queries to avoid SQL injection attacks. Then you don't have to concern yourself with quotation marks in the data. Of course you must still validate and sanitize, but you don't need to convert the quotes/appostrophes, and no htmlentities needed.

Please note that the Adobe Forums do not accept email attachments. If you want to embed a screen image in your message please visit the thread in the forum to embed the image at http://forums.adobe.com/message/4828130#4828130

Replies to this message go to everyone subscribed to this thread, not directly to the person who posted the message. To post a reply, either reply to this email or visit the message page:

To unsubscribe from this thread, please visit the message page at . In the Actions box on the right, click the Stop Email Notifications link.

Start a new discussion in Developing server-side applications in Dreamweaver by email or at Adobe Community

For more information about maintaining your forum email notifications please go to http://forums.adobe.com/message/2936746#2936746.

Rob Hecker2

Legend

Thank you Rob,

At the risk of becoming a complete pain, I have one final query with regards to the mysql_connect.

You mentioned that it would be supported for a while yet, but I have noticed that my connection is mysql_pconnect in the following format:

$hostname_connadd = "localhost";

$database_connadd = "database";

$username_connadd = "username";

$password_connadd = "password";

$connadd = mysql_pconnect($hostname_connadd, $username_connadd, $password_connadd) or trigger_error(mysql_error(),E_USER_ERROR);

What is the difference? Does it matter? Many moons ago when I set up the connection this is how I presume dreamweaver did it, do I need to change this connection to mysql_connect (I am concerned that the pconnect won't have the same support), if I do need to change it can I just literally remove the p (I am imagining no), so how would I change to mysql_connect if it is the case that I need to.

When I contacted my possible hosting company they seem to support mysql_connect but have limited options with mysql_pconnect.

Thank you again and sorry for all the questions, you have been so helpful.

Date: Thu, 8 Nov 2012 09:11:44 -0700

From: forums_noreply@adobe.com

To: linda.barker7@hotmail.com

Subject: Confusion with html entities

Re: Confusion with html entities

created by Rob Hecker2 in Developing server-side applications in Dreamweaver - View the full discussion

When we include code snippets in this forum the programmers (if they were using PHP) would use html entities to correctly display the code, but normally you would not want to use htmlentities. If you apply htmlentities to text that has already had it applied, you end up creating entities out of the entities. So the answer is no, don't apply htmlentities to the text returned from the database.

Please note that the Adobe Forums do not accept email attachments. If you want to embed a screen image in your message please visit the thread in the forum to embed the image at http://forums.adobe.com/message/4832961#4832961

Replies to this message go to everyone subscribed to this thread, not directly to the person who posted the message. To post a reply, either reply to this email or visit the message page:

To unsubscribe from this thread, please visit the message page at . In the Actions box on the right, click the Stop Email Notifications link.

Start a new discussion in Developing server-side applications in Dreamweaver by email or at Adobe Community

For more information about maintaining your forum email notifications please go to http://forums.adobe.com/message/2936746#2936746.

mysql_pconnect creates a persistent connection, whereas mysql_connect drops the connection immediately after execution. Both are going to close when the script closes anyway.

There is probably no reason for you to be using the 'p'connect, so you can probably drop it and everything will work fine.

There are situations where it is necessary or desirable to use the p connect, but chances are, if your code required it, you would be aware of it.

So, you probably never should have been using pconnect in the first place, but it's probably also no big deal that you did.

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded