[RESOLVED] Angled Brackets - <>

Mr_Jezz

Hi,

I've noticed that when I insert a record into my mysql DB from a php script, if for example I have a text field and I try to insert some text featuring angled brackets, any text contained within the brackets will be removed, and in this instance anything after the brackets will not be inserted. I imagine it's preventing anyone from inserting dodgy code, injection attacks etc, but I guess there's a way to stop it doing this? I use mysql_real_escape_string prior to the insert statement already, but it doesn't seem to effect this issue.

Any help would be much appreciated, cheers.

laserlight

Are you using [man]strip_tags/man in your code, by any chance?

djjjozsi

i use this script to clear evrything script and format from a document:


<?php

$a = array ("'<script[^<]*?>.*?</script>'si", // javascript
              "'<[\/\!]*?[^<>]*?>'si",  // HTML elements clear
              "'([\r\n])[\s]+'",  // spaces
              "'&(quot|#34);'i",  // html entities
              "'&(amp|#38);'i",
              "'&(lt|#60);'i",
              "'&(gt|#62);'i",
              "'&(nbsp|#160);'i",
              "'&(iexcl|#161);'i",
              "'&(cent|#162);'i",
              "'&(pound|#163);'i",
              "'&(copy|#169);'i",
              "'&#(\d+);'e");  

$b = array ("",
               "",
               "\\1",
               "\"",
               "&",
               "<",
               ">",
               " ",
               chr(161),
               chr(162),
               chr(163),
               chr(169),
               "chr(\\1)");

$text = preg_replace ($a, $b, $doc);

?>

Mr_Jezz

laserlight;10894094 wrote:
Are you using [man]strip_tags/man in your code, by any chance?

Hi there, I am not using strip_tags() in my code. Before the sql insert i do the following:

$comment = stripslashes($_POST[comment]); // remove slashes
$new_comment = mysql_real_escape_string($comment); // clean up

Magic quotes is turned on, (which i know is ill advised). if i comment out the above it has no effect, i.e. any text inside <> is removed.

laserlight

hmm... are you sure that the text is removed? For example, if you just try and print out the text with properly escaping it for output, browsers might not display it at all. As such, do you use [man]htmlspecialchars/man or [man]htmlentities/man when printing out the text?

Mr_Jezz

laserlight;10894191 wrote:
hmm... are you sure that the text is removed? For example, if you just try and print out the text with properly escaping it for output, browsers might not display it at all. As such, do you use [man]htmlspecialchars/man or [man]htmlentities/man when printing out the text?

hmm, all was not exactly as I thought. Closer inspection of the database table showed that the characters were present, I tried inserting

<this is a test>

And this is exactly what appeared in the database, however nothing was displayed on my web page, not even the brackets, just a blank. Picking up on what you were saying, I made use of htmlentities() and all the bracketed text is now displaying correctly.

Thank you for your assistance, apologies for my slight misunderstanding of the problem:bemused:

laserlight

Ah. Incidentally, this actually prevents malicious script injection (that can cause cross site scripting attacks). You sanitised the input to your database, but did not sanitise your output to your users' browsers, until now.

Mr_Jezz

laserlight;10894203 wrote:
Ah. Incidentally, this actually prevents malicious script injection (that can cause cross site scripting attacks). You sanitised the input to your database, but did not sanitise your output to your users' browsers, until now.

Thanx for the tip, very good to know!