get_magic_quotes_gpc()) is off
magic_quotes_gpc is off? Great! 🙂
I have included some php code that is the basis of what I am doing in a page called test.php, could you look and tell me if I am right or wrong and also about the quoting I would be most appreciated.
Now, since magic_quotes_gpc is off, your "strip quotes if already in" part is wrong. You do not need to strip slashes since no slashes would have been added in the first place. Those slashes that do exist are legitimate and should not be removed.
Therefore, I would expect something like this:
function mySQLSafe($value) {
// Quote value
if(version_compare(phpversion(),"4.3.0")=="-1") {
$value = mysql_escape_string($value);
} else {
$value = mysql_real_escape_string($value);
}
return trim($value);
}
Note that trim() returns a value, so I have fixed that in the above example. Incidentally, you might want to make life simpler and just require a minimum of PHP 4.3.0 instead of doing that version check, especially since the entire PHP 4 release series is obsolete.
Next, let's examine this line:
echo "<input type='text' name='meta_description' id='meta_description' value='".htmlspecialchars($_GET['meta_description'])."' size='100' maxlength='254'>";
You escaped $_GET['meta_description'] for printing as HTML. This is correct, though unfortunately you failed to do this in some other lines. However, there is a catch: by default, htmlspecialchars() does not escape single quotes. But you are using single quotes to quotes the attribute value (value='".htmlspecialchars($GET['meta_description'])."'). This mean that if $GET['meta_description'] contains the value "John's thing", the attribute will come out as "value='John's thing'". See the problem? A forgiving HTML parser will parse that as "value='John' and ignore the rest, and this causes the truncation that you encountered.
One solution to this problem is to use double quotes to quote instead:
echo '<input type="text" name="meta_description" id="meta_description" value="' . htmlspecialchars($_GET['meta_description']) . '" size="100" maxlength="254">';
This is what I prefer. However, another solution is to specify that you want htmlspecialchars() to escape single quotes as well:
echo "<input type='text' name='meta_description' id='meta_description' value='" . htmlspecialchars($_GET['meta_description'], ENT_QUOTES) . "' size='100' maxlength='254'>";
