Inputting HTML code into database

[mhodge87]

To make long discussion fairly short:

I have a textbox that a user enters in an image tag:

<img src="test.jpg" alt="test">

However when I mysql_real_escape_string it into the database to store this, it puts in / through out it.

Is there a way so that way I can enter that into the database without compromising security?

[NogDog]

mysql_real_escape_string() should not be putting any additional characters into your database. It does escape certain characters with a back-slash ("\") for use within your SQL statement, but that back-slash only appears in the SQL and does not make it into the database itself. If you are seeing spurious "\" characters in your data, then you probably have the infamous magic_quotes_gpc setting activated on your server. In that case, PHP is automatically doing its own escaping of form inputs, and then mysql_real_escape_string() is escaping those back-slashes with its own back-slash, and thus you are seeing the magic_quotes slashes in the DB.

Options:

1. Turn off magic_quotes_gpc either via system settings (php.ini) if you have access, or a local .htaccess file setting.

2. In your script, use [man]get_magic_quotes_gpc()[/man] to see if it's turned on, and if so do a [man]stripslashes/man of the data before applying mysql_real_escape_string() to it.

3. Kidnap your system administrator and force him to watch Pauly Shore movies and listen to Hanson CDs until he breaks down and agrees to disable the magic_quotes_gpc option on your server.

[WeAnswer_IT]

This may not be applicable to you, but I suggested the same thing on another post.

Since you are asking users to enter an img tag into a field, wouldn't it be easy to store the attributes of each tag rather than the whole thing?

Instead of storing:

[row #][img tag]
[row 1][<img src="dogs.jpg" height="10" width="8" />]
[row 2][<img src="cats.gif" height="15" width="17" />]
[row 3][<img src="food.png" height="12" width="11" />]

Wouldn't it make more sense to store:

[row #][name][ext][ht][wt][...whatever...]
[row 1][dogs][jpg][10][08]
[row 2][cats][gif][15][07]
[row 3][food][png][12][11]

That way, when you are displaying your image tags, you could handle different formats differently (if necessary), or scale your images based on height and width.

It also makes it easier to constrain user input. Instead of letting a user enter any value for "height", you could force them to enter an integer, or an integer between 10 and 1000.