PHP Development
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me

The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.

Go Back   Dev Shed ForumsProgramming LanguagesPHP Development

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old November 10th, 2012, 07:17 PM
ohmynexus ohmynexus is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Nov 2012
Posts: 7 ohmynexus User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 h 43 m 36 sec
Reputation Power: 0
Issue with using single quotes in strings to be used in href

I'm having another issue. My site will allow people to create 'shops' wherein they can post their items for sale. These shops are able to be named and in some cases will contain the ' symbol. (Lucy's Clocks for example).

But when used like this:
PHP Code:
echo "<a href='somepage.php?view=$userShop'>$userShop</a>" 

Will redirect to the page Lucy because she has a ' in her title that ends the href quote.

As a temporary fix, I've changed to:
PHP Code:
echo "<a href=somepage.php?view=$userShop>$userShop</a>" 

But this method is deprecated and not in compliance with the strict XHTML i am currently working with.

I believe another fix would be to end the php, display it as normal html, but it would be quite messy.

Does anyone know of any better fixes to the problem?

Note:
The strings go through a sanitize process before being compared:
PHP Code:
function sanitizeString($var)
    {
        
$var strip_tags($var);
        
$var htmlentities($var);
        
$var stripslashes($var);
        return 
mysql_real_escape_string($var);
    } 

Any answers would be greatly appreciated.

Thanks!

Reply With Quote
  #2  
Old November 10th, 2012, 08:23 PM
requinix's Avatar
requinix requinix is online now
Still alive
Dev Shed God 16th Plane (12500 - 12999 posts)
 
Join Date: Mar 2007
Location: Washington, USA
Posts: 12,864 requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)requinix User rank is General 120th Grade (Above 100000 Reputation Level)  Folding Points: 417516 Folding Title: Super Ultimate Folder - Level 1Folding Points: 417516 Folding Title: Super Ultimate Folder - Level 1Folding Points: 417516 Folding Title: Super Ultimate Folder - Level 1Folding Points: 417516 Folding Title: Super Ultimate Folder - Level 1Folding Points: 417516 Folding Title: Super Ultimate Folder - Level 1Folding Points: 417516 Folding Title: Super Ultimate Folder - Level 1
Time spent in forums: 5 Months 1 Week 5 Days 5 h 56 m 10 sec
Reputation Power: 8977
Send a message via AIM to requinix Send a message via MSN to requinix Send a message via Yahoo to requinix Send a message via Google Talk to requinix
Your universal sanitizer is bad. It does way more than it ever should for a single use, and doesn't even do some things you'll need.

Here's how you sanitize stuff, in chronological order:
1. When stuff comes from the URL or a form and magic_quotes is enabled then, and only then, stripslashes() it. Do that as early as possible.
2. If you specifically want to remove - remove - anything that looks like an HTML tag then use strip_tags(). Do that as early as possible.
3. When you put a string directly into a SQL query and you aren't sure what characters it could contain, use mysql_real_escape_string(). Do that right when you put it into the query.
4. If you're putting something into a link (like an <A>) and you aren't sure what characters it could contain, use urlencode(). Do that right when you put it into the URL.
5. When you put a string directly into HTML and you aren't sure what characters it could contain, use htmlspecialchars() or htmlentities(). Do that right when you put it into the HTML. Mind your ENT_QUOTEs.

So
PHP Code:
echo "<a href='somepage.php?view="htmlentities(urlencode($userShop), ENT_QUOTES), "'>"htmlentities($userShop), "</a>"

Reply With Quote
Reply

Viewing: Dev Shed ForumsProgramming LanguagesPHP Development > Issue with using single quotes in strings to be used in href

Developer Shed Advertisers and Affiliates



Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 


Powered by: vBulletin Version 3.0.5
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.

© 2003-2013 by Developer Shed. All rights reserved. DS Cluster - Follow our Sitemap