Help with escaping

[ffsja]

I'm pulling data from MySQL in php and there are apostrophes in my database data that are causing me problems. I'm wondering, is there a way to escape apostrophe characters (or other characters) as they are coming OUT of mysql using php?

thank you!

[dagon]

if you use double quotes on the string there will be no issues with apostrophes

[ffsja]

Right, thank you. But the problem is that I am having a whole bunch of strings returned that then go into a <SELECT> <OPTION> block with each string being it's own <OPTION>. So do I check each string automatically and remove the apostrophe's IF they are there? Usually there are no apostrophes in the data...

thanks!

[dagon]

as long as the html use the appropriate quoting i don't see an issue, perhaps an example would help.

[ixalmida]

The only way I could see it being a problem is if you're doing something like:

<input type="text" value="<?php echo $text ?>">

A double-quote in $text would close the value quote. However, this can be easily overcome:

<input type="text" value="<?php echo htmlentities($text, ENT_QUOTES) ?>">

But if quotes are escaped in MySQL, you'll have to stripslashes($text) first.

[ffsja]

Thank you both. What I'm trying to do actually is output $course_block (which has many lines of text that includes apostophes, which are the problem) inside a javascript block. Here's the javascript:

<script type="text/javascript">
var count = 0;
$(function() {
$('p#add_field').click(function() {
count += 1;
$('#container').append('<select id="field_' + count + '" name="fields[]' + '"> <?php echo htmlspecialchars($course_block, ENT_QUOTES); ?> </select>');
});
});

</script>

As you can see, I tried using htmlspecialchars() to output the data and while it DID allow me to create the <SELECT> block when the function was run it didn't show any data inside. Assuming the code that populate $course_block works (which it does), what else could be the problem? Here's the code for $course_block just so you have it:

$sql = "SELECT title, subject, coursenum, section, crn, instructor, credits, price FROM catalog ORDER BY subject,coursenum";
$result = mysql_query($sql);
while ($row = mysql_fetch_array($result)) {
$subject = $row['subject'];
$coursenum = $row['coursenum'];
$section = $row['section'];
$crn = $row['crn'];
$title = $row['title'];
$instructor = $row['instructor'];
$credits = $row['credits'];
$price = $row['price'];
$course_block .= "<option value=\"$subject-$coursenum-$section-$crn-$title-$instructor-$credits-$price\">$subject $coursenum- $title- Instructor: $instructor- Section: $section- Credits: $credits- Price: \$$price</option>";
}

[dagon]

you can try this, i found it with google, i don't use js enough to comment further

function javascript_escape($str) {
	$new_str = '';

$str_len = strlen($str);
for($i = 0; $i < $str_len; $i++) {
	$new_str .= '\\x' . dechex(ord(substr($str, $i, 1)));
}

return $new_str;
}

[ffsja]

OMG it worked! What I did was put that code into my external PHP file and then changed my javascript to read:

<script type="text/javascript">
var count = 0;
$(function() {
$('p#add_field').click(function() {
count += 1;
$('#container').append('<select id="field_' + count + '" name="fields[]' + '"> <?php echo javascript_escape($course_block); ?> </select>');
});
});

</script>

Looks super weird when you view page source but when I run the function by clicking a link the new SELECT box shows up exactly as desired!

Thank you so much!!

[johanafm]

dagon;10934865 wrote:

you can try this, i found it with google, i don't use js enough to comment further

The reason for all this is that running html_entities before echoing will change nothing for the actual js. A ' is turned into &apos; serverside, and the browser turns it back into ' which screws up the javascript.

The function you posted take the ascii value for each character, and turns it into hex, and javascript can deal with \xNNNN as a character.

But if the only character causing problem is ', I'd rather str_replace("'", '\x' . dechex(ord("'"))) than loop over each character.

[ffsja]

Thanks for explaining that 🙂