<?php
$text = htmlentities($_POST['text']);
$query = sprintf("INSERT INTO $table (`user_id`, `post_text`) VALUES ($d, $s);",$user_id,$text);
customQueryFunction($query);
?>
Refactorings
No refactoring yet !
NullUserException
August 10, 2010, August 10, 2010 19:33, permalink
First of all this would be a great question for SO, just post it there. This is a short and objective enough question.
- This is not safe from SQL Injections since by default htmlentities() does not convert quotes (' and ")
- You can prepare through actual prepared statements. Google "PDO Prepared Statements". You should also escape your input using mysql_real_escape_string() when appropriate.
- Storing code that's been converted with htmlentities() increases the size of your database. If you can remember to call htmlentities() every time before you output it, you'd save some space.
Not only that but it also removes the ability to allow certains users (admins for example) to insert HTML.
- An alternative to BBCodes would be having a limited subset of HTML elements permitted (this can be made flexible by allowing different roles to have be allowed to use different tags); and use something like HTMLPurifier to filter your HTML tags.
Ants
August 10, 2010, August 10, 2010 19:34, permalink
You also need to prevent SQL in injection. Consider what happens in the posted text is:
Hi'); DROP TABLE $table; --
I love this XKCD cartoon to remind me of SQL injection attacks: http://xkcd.com/327/
I think that using the ENT_QUOTES parameter with htmlentities() function may help a little bit.
Anri
August 10, 2010, August 10, 2010 20:28, permalink
@NullUserException
Is there a difference between sprintf and PDO Prepare statements?
I am using Wordpress's Prepare Function, and with sprintf, they are very similar.
The only thing missing in my sanitizing would be escaping it from possible SQL injection correct?
Oh. And about SO, I wasn't very sure whether this would have been a valid question for SO. But I suppose it was in your statement.
So the revision would be.
<?php
$text = mysql_real_escape_string($_POST['text']);
$query = sprintf("INSERT INTO $table (`user_id`, `post_text`) VALUES ($d, $s);",$user_id,$text);
?>
<?php
echo htmlentities($text);
?>
VanTMark
August 22, 2010, August 22, 2010 06:23, permalink
Zapatorinus is good. I am fool adjflkfadf dsjje <a href=http://sdlklerwer.jsd>sdfjfwe</a> angfjsdf. Sorry me...
starringmoviest
August 24, 2010, August 24, 2010 19:28, permalink
hi i am new here just wana say hi to all members
Flowerbuth
August 24, 2010, August 24, 2010 20:52, permalink
What flowers do you like?
Loupepabpaush
December 12, 2010, December 12, 2010 09:31, permalink
motorized ride on car auto parts chevy carburetor mini no bake cheesecake 1982 suzuki gsx1000 katana 2006 dodge sprinter 2500 blue book price
skisshop
December 20, 2010, December 20, 2010 05:36, permalink
20k Spyder Aspen Ski Mens Jacket Coat Xl Herren 54 More From Seller. In stock at . Spyder Ski Wear for Less. Shop Our Wide Range of Spyder Ski Gear.Cross Country (XC) Downhill (DH) Freeride / All Mountain Hardtail Cross Country (XC) Dirt Jump Freeride Womens Ladies Womens Ladies
<a href=http://bngfdjkhghgd.t35.com>nz ski resort weather</a>
semsomign
December 22, 2010, December 22, 2010 22:55, permalink
Hey, I wanted to know of any tool or i think you call them Aps to show you the best deals? I'm aware that you can type in a search in google and you only get the advertisers that paid the most, not the best deals. Any help would be great.
Sylvitan
December 31, 2010, December 31, 2010 05:30, permalink
Hello ! I'm new on this forum, hope to talk to you soon :)
I love carsn seotons and tuning, and you ?
Gold Load
January 10, 2011, January 10, 2011 09:50, permalink
Spectacular blog, by means of lover that wrote so often. The pipe reaction that writes to-date bumf :)
mrtesty
January 17, 2011, January 17, 2011 22:50, permalink
Delete shis text plz. Sorry
turkeyegypt
February 1, 2011, February 01, 2011 15:15, permalink
Hello all! check pliz
somebody know information about egypt miting in that moment? and who have photo from Egypt? plz give me a link to see this photo!!
sorry if i post this messege wrong topic.
Fxxxxcking dirty egyptians!!!
TheAiriona
February 17, 2011, February 17, 2011 15:36, permalink
How do you do?
ByncopposyMup
March 10, 2011, March 10, 2011 14:33, permalink
Do you have inspiron 1721 raid, hp pavilion model a810n and hp pavilion dv5-1007 review?
Braipleri
April 30, 2011, April 30, 2011 12:11, permalink
Сохраненная копия Обезьяны идут по своим делам объявления знакомства для секса красноярск не Пролетел месяц, дружба любовь. Коммерческая недвижимость 23 апр 2011 доска объявлений города Ноябрьска Объявления о продаже водного транспорта .Авто-аудио и видео Поиск интересующего автомобиля среди предложений частных лиц и автомобильных компаниях.Было тяжеловато совмещать учебу, работу и бокс, но я учился только на четверки Я хочу оставить именно след!Пришлите нам письмо со следующими данными на почту: 15 окт 2005 Для всех нас было бы нелишним сходить на прием к кардиологу.Аренда квартир без посредников и по лучшим ценам на рынке благодаря доступу к базе . Рубрика: техническая площадь; сдам: в этой рубрике публикуются объявления о сдаче в аренду офисных 06. Объявления о продаже и аренде квартир, комнат, домов, участков, офисов и коммерческой недвижимости в Санкт-Петербурге и Ленинградской области.
Anastasssia
June 3, 2011, June 03, 2011 01:44, permalink
Купила аппарат Canon 4450 с картриджем canon 728. Не могу найти совместимый картридж. Оригинальные очень дорогие!
Может кто подскажет, что делать, а то напечатал пачку бумаги и кончился...
flellareire
September 4, 2011, September 04, 2011 11:51, permalink
Thanks mate... just dropped by.!!!!! Will look for BIKE STN when we get to Seattle. Still in Buenos Airies.!!!!!
NarbrommagDug
September 7, 2011, September 07, 2011 05:57, permalink
Thanks mate... just dropped by.!!!!! Will look for BIKE STN when we get to Seattle. Still in Buenos Airies.!!!!!
abrantTar
September 19, 2011, September 19, 2011 17:19, permalink
Thanks mate... just dropped by.!!!!! Will look for BIKE STN when we get to Seattle. Still in Buenos Airies.!!!!!
Cacralley
September 20, 2011, September 20, 2011 21:24, permalink
Thanks mate... just dropped by.!!!!! Will look for BIKE STN when we get to Seattle. Still in Buenos Airies.!!!!!
Peceallency
October 11, 2011, October 11, 2011 06:25, permalink
charter furniture addison
unique painted furniture
sharpen kitchen knives
bath discount tub
ameriplan home business
lowes home improvement district offices
renovating your kitchen
decorating a small kitchen
how to install a kitchen faucet
polywood patio furniture
asheville builder developer home
building cost home material
unique furniture store
carsons of high point furniture
dealer furniture new
rorkedmedia
November 1, 2011, November 01, 2011 12:16, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
Deannyten
November 15, 2011, November 15, 2011 17:11, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
vostenofs
November 16, 2011, November 16, 2011 14:48, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
Peeleaskirl
November 19, 2011, November 19, 2011 19:00, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
nocaoccub
November 12, 2011, November 12, 2011 07:59, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
erunnyutesy
November 15, 2011, November 15, 2011 07:44, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
Rilsotbloth
November 20, 2011, November 20, 2011 18:12, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
deermcregmene
December 22, 2011, December 22, 2011 20:25, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
boubjesee
November 27, 2011, November 27, 2011 07:40, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
elafDeema
November 27, 2011, November 27, 2011 19:40, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
Anaedlypneula
December 5, 2011, December 05, 2011 09:17, permalink
cvs pharmacy h57 http://exclusiverx.com/products/metoclopramide.htm pergolide equine canadian pharmacy
SWASIAWOUMS
December 24, 2011, December 24, 2011 22:08, permalink
BloombergFTR, GS, CVS, DHI, PM - Wednesday Notable Stocks with Volume at NYSEHealth Talk & YouCVS Caremark Corporation (CVS Caremark) is a pharmacy healthcare provider in the United States.
addichaccipsy
December 28, 2011, December 28, 2011 11:02, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
FabsBlammaKah
December 28, 2011, December 28, 2011 20:22, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
PienWonee
December 29, 2011, December 29, 2011 01:52, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
Invoixmoott
December 29, 2011, December 29, 2011 21:36, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
beistMuGseeks
December 29, 2011, December 29, 2011 22:13, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
Feriordedia
January 16, 2012, January 16, 2012 13:10, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
Waisistegleri
January 17, 2012, January 17, 2012 10:37, permalink
For the sake of one hundred thousand is nothing to regret mite. ( kal-myts. )
Djimbo-STin
January 19, 2012, January 19, 2012 01:52, permalink
The Company In-Disguise .Com
Glad to introduce you – private and Fully Automatic VPN Service!
In-Disguise. Com - Fully Automatic VPN service, you don’t have to waste time on:
1 - Search Supports if disconnected from a server, search for a standard installation “OpenVPN client”
spend time for installing downloaded configs to the program.
Troubleshoot the upgraded system for a stable connection to the VPN.
access to all servers for just 9 EURO.
DoubleVPN, OPENVPN and PPTP VPN - Access to 18 servers in 10 countries!
Subscribe to All Servers of Our Service for 9 Euro; 3 months = 20 Euro; 6 months = 35 Euro; 1 year = 55 Euro.
2 - Unique “VPN Client” is easy to install on all kinds of Operating Systems: MAC / Windows / Liinux!!!
Will allow you to switch easily between the VPN servers in USA / DE / UK / IT / NL / LU / EG / PA / RO / MY Continuing
In the near future our service will be available in Spain, Greece, Sweden, Mexico, Czech Republic, Poland, China, Belgium ...
Types of VPN connections included in a single subscription - DoubleVPN and OpenVPN.
3 - The program features an easy configuration of a VPN connection to your Internet: -automatically Block Internet Connection when Disconnected from a VPN.
- Automatic connection to the VPN when you turn on the Internet.
4 - Company Takes All Kinds Of Payments in Full Auto Mode!
WebMoney / Visa / Master Card / PayPal / Liberty Reserve / BitCoin / SMS and many others.
Our site is here in-disguise .com /?aff=69
Sincerely, In-Disguise .Com
========
Also,our Service has a unique N-tier, Private Partnership Program:
You will get 35% of total payments of your customers!
Registration only for an invite code - a code targeted at a single registration .
After registration you can become an Affiliated owner
Proposing an affiliation to your friends you can get up to 11% of their profits.
Our sister site is vpnincome .Com
If you are interested in our VPN Service or an Affiliation program, please refer all questions to :
ICQ: 6850058
E-mail: paul_okenfold@yahoo.com
ST-SlavaT
January 19, 2012, January 19, 2012 20:38, permalink
The Company In-Disguise .Com
Glad to introduce you – private and Fully Automatic VPN Service!
In-Disguise. Com - Fully Automatic VPN service, you don’t have to waste time on:
1 - Search Supports if disconnected from a server, search for a standard installation “OpenVPN client”
spend time for installing downloaded configs to the program.
Troubleshoot the upgraded system for a stable connection to the VPN.
access to all servers for just 9 EURO.
DoubleVPN, OPENVPN and PPTP VPN - Access to 18 servers in 10 countries!
Subscribe to All Servers of Our Service for 9 Euro; 3 months = 20 Euro; 6 months = 35 Euro; 1 year = 55 Euro.
2 - Unique “VPN Client” is easy to install on all kinds of Operating Systems: MAC / Windows / Liinux!!!
Will allow you to switch easily between the VPN servers in USA / DE / UK / IT / NL / LU / EG / PA / RO / MY Continuing
In the near future our service will be available in Spain, Greece, Sweden, Mexico, Czech Republic, Poland, China, Belgium ...
Types of VPN connections included in a single subscription - DoubleVPN and OpenVPN.
3 - The program features an easy configuration of a VPN connection to your Internet: -automatically Block Internet Connection when Disconnected from a VPN.
- Automatic connection to the VPN when you turn on the Internet.
4 - Company Takes All Kinds Of Payments in Full Auto Mode!
WebMoney / Visa / Master Card / PayPal / Liberty Reserve / BitCoin / SMS and many others.
Our site is here in-disguise .com /?aff=69
Sincerely, In-Disguise .Com
========
Also,our Service has a unique N-tier, Private Partnership Program:
You will get 35% of total payments of your customers!
Registration only for an invite code - a code targeted at a single registration .
After registration you can become an Affiliated owner
Proposing an affiliation to your friends you can get up to 11% of their profits.
Our sister site is vpnincome .Com
If you are interested in our VPN Service or an Affiliation program, please refer all questions to :
ICQ: 6850058
E-mail: paul_okenfold@yahoo.com
Bingo-Super
January 20, 2012, January 20, 2012 15:05, permalink
The Company In-Disguise .Com
Glad to introduce you – private and Fully Automatic VPN Service!
In-Disguise. Com - Fully Automatic VPN service, you don’t have to waste time on:
1 - Search Supports if disconnected from a server, search for a standard installation “OpenVPN client”
spend time for installing downloaded configs to the program.
Troubleshoot the upgraded system for a stable connection to the VPN.
access to all servers for just 9 EURO.
DoubleVPN, OPENVPN and PPTP VPN - Access to 18 servers in 10 countries!
Subscribe to All Servers of Our Service for 9 Euro; 3 months = 20 Euro; 6 months = 35 Euro; 1 year = 55 Euro.
2 - Unique “VPN Client” is easy to install on all kinds of Operating Systems: MAC / Windows / Liinux!!!
Will allow you to switch easily between the VPN servers in USA / DE / UK / IT / NL / LU / EG / PA / RO / MY Continuing
In the near future our service will be available in Spain, Greece, Sweden, Mexico, Czech Republic, Poland, China, Belgium ...
Types of VPN connections included in a single subscription - DoubleVPN and OpenVPN.
3 - The program features an easy configuration of a VPN connection to your Internet: -automatically Block Internet Connection when Disconnected from a VPN.
- Automatic connection to the VPN when you turn on the Internet.
4 - Company Takes All Kinds Of Payments in Full Auto Mode!
WebMoney / Visa / Master Card / PayPal / Liberty Reserve / BitCoin / SMS and many others.
Our site is here in-disguise .com /?aff=69
Sincerely, In-Disguise .Com
========
Also,our Service has a unique N-tier, Private Partnership Program:
You will get 35% of total payments of your customers!
Registration only for an invite code - a code targeted at a single registration .
After registration you can become an Affiliated owner
Proposing an affiliation to your friends you can get up to 11% of their profits.
Our sister site is vpnincome .Com
If you are interested in our VPN Service or an Affiliation program, please refer all questions to :
ICQ: 6850058
E-mail: paul_okenfold@yahoo.com
Tawdielflyday
January 20, 2012, January 20, 2012 17:04, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe. what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
KNEEDGINGTHOG
January 20, 2012, January 20, 2012 19:25, permalink
KOVAL ! why do you only respond to people who threaten to unsubscribe... what about me....Id like a shout out too ....I watched all your videos....TWICE.....i loved you when you weren't? famous.... *sigh*
Lets say I am building a forum, and I am sanitizing a forum post submitted by a user.
The users submits a post from a text field name "text".
It goes into the back-end of the code where it is being sanitize.
$_POST['text']
What would be the best approach to sanitize a forum post?
My approach would be:
- Prepare through **sprintf**.
- Use **htmlentities** to stop Html being outputted.
- Use *shortcodes* to customize the post's style.
- Then Query a Insert into Database.
When I want to Get this information. I can simply **echo** it out.
Is this good enough or am I missing something?