mysql_real_escape_string causing complications

PHP
1

I’m trying to display variables using mysql_real_escape_string so it allows commas to be displayed. Only problem is that this one area that I’m working with is actually a very sensitive area in which I’m using php, html, and javascript all within the same line of code. So when the mysql_real_excape_string bypasses a comma it actually escapes out of the intended language of code. Is there a way around this, or do I need to use another method to display?


<?php
..........
$sqlEvent = "SELECT * FROM eventscalendar where eventDate='".$monthstring."/".$daystring."/".$year."'";
				$resultEvents = mysql_query($sqlEvent);
				$events = mysql_fetch_array($resultEvents);
		
				$holVal = mysql_real_escape_string($events['holiday']);	
				$ehVal = mysql_real_escape_string($events['heading']);
				$e1Val = mysql_real_escape_string($events['event1']);
				$e2Val = mysql_real_escape_string($events['event2']);
				$e3Val = mysql_real_escape_string($events['event3']);
				$e4Val = mysql_real_escape_string($events['event4']);
				
				
				$tooltip = "<div>".$events['eventDate']." <br/><br/><b>".$holVal."<br/>".$ehVal."<br/>".$e1Val."<br/>".$e2Val."<br/>".$e3Val."<br/>".$e4Val."</b></div>";

echo "class = 'event'";


//////this is where I'm having trouble

						echo "><span onmouseover='tooltip.show(\\"$tooltip\\");' onmouseout='tooltip.hide();'>\
". $i ."<h6>".$holVal."<br/>".$ehVal."</h6></span></td>\
";

?>

Thanks

2

felgall — that was my reaction, but Scallio meant you don’t need to use mysql_real_escape_string to display data as it comes OUT of the result set.

3

I just got it. The htmlspecialchars did end up working as did htmlentities. This is what I did



echo "><span onmouseover='tooltip.show(".htmlspecialchars($tooltip, ENT_QUOTES).");' onmouseout='tooltip.hide();'>\
". $i ."<h6>".$events['holiday']."<br/>".$events['heading']."</h6></span></td>\
";

Works perfect.
Does anyone know if it’s better to use one over the other?

Thanks everyone for the help.

4

Really all I need this for is for an event calendar, I’m not concerned about any information being vulnerable. I have an editing page to place information into the database, then I have a calendar that is only used to view the events that were placed into the database.

I apologize, I misspoke about the comma, it’s an apostrophe (single quotes) and double quotes etc that won’t translate over.

It looks like PREPARE might be the way to go, but like I said I’m very new to php and mysql, know nothing of mysqli, and can’t seem to find any online examples of this that make very much sense to me.

5

htmlspecialchars() converts all of the characters that need to be converted to output text in HTML

htmlentities() converts every character for which an entity code exists including the 99% of characters that don’t need converting for display in HTML.

6

Between htmlspecialchars() and htmlentities() do you guys recommend one over the other?

7

Sorry my post was a bit vague.
You do need to use mysql_real_escape_string in the SELECT query itself, but once you’ve fired the query and gotten back the result set, and -as you say- you need to display the data you don’t need to apply mysql_real_escape_string to that result set. As said before, you should use something like htmlentities() for that.

Sorry for the confusion.

8

So as it was open to misinterpretation it was appropriate to clarify what it meant.

9

mysql_real_escape_string is used to make sure the data doesn’t get mixed up with the query. That can happen just as easily with SELECT statements as with any other and is perhaps the more likely target for someone trying to extract passwords from your database.

Also it doesn’t matter whether the value you are escaping is being placed in the database or not - that it can contain data that potentially breaks the SQL is the reason for using it.

For example:

“SELECT * FROM sometable WHERE user=‘$user’”

and someone enters a value into $user of

x’ OR 1=1

without mysql_real_escape_string($user) that request now retrieves all the users instead of just a specific one.

The better solution to the problem is to use PREPARE statements using either mysqli or PDO so that the data is completely separate from the SQL and so mysql_real_escape_string isn’t needed at all.

10

I’m very new to php and I don’t entirely understand what you mean by stripping magic quotes off. Are you just referring to the \“tooltip\” and
? Those seemed to be the only way that I could incorporate the javascript within the php code.

Or are you talking about disabling the magic quotes within the php file?

As far as the htmlspecialchars, I tried this


$holChar = htmlspecialchars($events['holiday'], ENT_QUOTES);
$headChar = htmlspecialchars($events['heading'], ENT_QUOTES);

echo "><span onmouseover='tooltip.show(\\"$tooltip\\");' onmouseout='tooltip.hide();'>\
". $i ."<h6>".$holChar."<br/>".$headChar."</h6></span></td>\
";

And I still get the same mistake.

11

If you have magic quotes enabled then strip it off and then apply mysql escaping function.

12

You only need mysql_real_escape_string for stuff you put in the database (ie the values of INSERT and/or UPDATE queries), not for SELECT queries :slight_smile:

13

NT_Cookies you don’t escape for mysql when you are doing something totally different with the data (i.e. displaying it in the browser). [fphp]htmlspecialchars[/fphp] is probably more appropriate, or if your values contain markup that should be written directly, then do nothing.