unexpected T_CONSTANT_ENCAPSED_STRING

cybernet2u

// 09 Announcement code to replace the Mass PM system / start
// http://xList.ro/
function status_change($id) {
    mysql_query('UPDATE announcement_process SET status = 0 WHERE user_id = '.sqlesc($id).' AND status = 1');
}

function ha****($var,$addtext="")
{
return md5("This Text ".$addtext.$var.$addtext." is added to muddy the water...");
}

function safe($var)
{
return str_replace(array('&', '>', '<', '"', '\''), array('&amp;', '&gt;', '&lt;', '&quot;', '''), str_replace(array('&gt;', '&lt;', '&quot;', ''', '&amp;'), array('>', '<', '"', '\'', '&'), $var)); // line 36
}

// 09 Announcement code to replace the Mass PM system / end

the error is
Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING, expecting ')' in /var/www/clients/clienti/webi/web/include/bittorrent.php on line 36

what is wrong ?

bradgrafelman

Look at the syntax highlighting near the end of the second array() on that line. See where it goes haywire?

What's the purpose of the three consecutive single quotes in that array, other than to cause a parse error? 🙂

jay6390

''')
should be
'')
or
'\'')

bradgrafelman

But that would remove all single quotes from the data.

I sure hope this "safe" function isn't supposed to be some sort of SQL escaping function...

jay6390

good point, but I did edit before you replied with that 😉

bradgrafelman

So it either removes all single quotes, or it replaces all single quotes with... single quotes?

This is why I asked the OP for clarification as to what that thing's actually supposed to be doing. :p

cybernet2u

premiso from phpfreaks . com said

return str_replace(array('&', '>', '<', '"', "'"), 
array('&amp;', '&gt;', '&lt;', '&quot;', "'"), 
str_replace(array('&gt;', '&lt;', '&quot;', "'", '&amp;'), 
array('>', '<', '"', "'", '&'), $var));

and it does work
thanks anyway😃
i don't intend to make advertising for that website
it's kind of a copyright

Weedpacket

Why are single quotes replaced by single quotes?

But see

return htmlspecialchars(htmlspecialchars_decode($var));