I have a form which will get user information, I am parsing most of the text already. I have set up a [code] tag which will allow users to insert any code they like. Once it's submitted, it will have syntax highlighting, etc. The problem I am running into is that when using htmlentities, htmlspecialchars, or similar to sanitize bad input, we get left with some funky looking outputs sometimes from inside the [code] block. I wish for this to look exactly how the user enters it, but to not actually do any actions on the website. For instance, echo('test'); becomes echo(\'test\'); eliminating the highlighting for the string. I wish for this to be displayed exactly as: echo('test'); however, it should not execute anything to remain safe.  Thanks in advance.
102270
I want to turn off PHP's magic quotes.  I don't have access to php.ini.  When I tried to add php_flag magic_quotes_gpc off to my .htaccess file, I get a 500 internal server error. This is what my .htaccess file looks like:  AddType x-mapp-php5 .php php_flag magic_quotes_gpc off   Then I tried to use ini_set('magic_quotes_gpc', 'O'), but that had no effect.  How do I turn magic quotes off?
74283
I was answering a question on Stack Overflow and required to use a trailing space in one of my code snippets.  I formatted it like so:  `&lt;a `   And it renders without the trailing space: &lt;a  Using the &lt;code&gt; tag does account for trailing spaces, though in my case it busts because of the &lt;. Here's my formatting with the &lt;code&gt; tag:  &lt;code&gt;&lt;a &lt;/code&gt;   Here's how it renders:  (Yes, you should see nothing there).  This is a pretty annoying bug. Can we get it fixed?
4554
How do I post text so that it is formatted as code?  What do I need to do so that my code shows up properly &mdash; not escaped or removed &mdash; when posted? And how to get the correct syntax highlighting?     For more information, see "" in the .
5278
I managed to do this  echo -n "command" &gt; /dev/tty1  The letters appear, and the cursor moves, but they are "ghosts" – if you hit Enter, nothing happens (they are not in stdin).  Edit:  In the middle of the below screenshot, you see why I see the use of this. (The line with a red caption, right below the line with a yellow caption.) As it is now, you are not really "editing" the note text; you are just asked to write a new text, which will replace the text of the note you are (not really) editing. Thus, I thought it could be remedied by simply pasting the old text into the tty: if the user hits enter, no modification is made. (This program is in Perl/MySQL, but I thought it would be more interesting to ask for a general solution than "how do I do this in Perl".)    Edit 2:  Here is the Perl code, that uses the C code below (works exactly as intended), as well as a new screenshot – hopefully this will clarify things beyond doubt :) Again, look at the middle of the screenshot, where the edit is made to the note text - this time around, the old text is there, for example if you just wanted to fix a typo, you won't have to retype the entire note text.  my $edit_note_text = $edit_note_data[2]; print BOLD, RED, " new text: ", RESET; system("writevt /dev/tty \"$edit_note_text\""); my $new_text = &lt;$in&gt;; $new_text = fix_input($new_text); my $set_text = "UPDATE notes SET note = \"$new_text\" WHERE id = $edit_note_id"; $db-&gt;do($set_text);
1144
I have a bespoke Content Type pertaining to venues. These are not user-creatable; they are all created from importing a trusted third-party feed, which sanitised the titles before they come to me (so there's no risk of  or  here). The titles might, however, contain accented characters (é, ô etc), apostrophes (') or ampersands (&amp;); these are coming out as HTML escapes (so &amp;#039; instead of an apostrophe, &amp;amp; instead of an ampersand, etc).  The Content Type Venue has a field title, which is a Node module element, so doesn't allow me to mess with its display settings. In the Node template page, I can use substitutions in the display of this title, but I can't work out how to make it be the raw text version. The title is currently set to display as %node:title and I tried using %node:title:raw and %node:title-raw in case one of those would magically work, but they had no effect.  I saw something that looks like a potential solution at  on zerotodrupal.posterous.com, which attaches to the hooks hook_preprocess_page and hook_preprocess_node, creating a new method like  function hhhdarkelegance_custom_title($node) {       return check_markup(strip_tags($node-&gt;title, '&lt;em&gt;&lt;em&gt;'));   }   but, while that blog post looks like it will work well for named HTML tags, I'm not sure it will necessarily deal with HTML entities, which are what my problem is here. I suppose I could do the opposite to the blog-post code and replace out &amp;amp; to &amp; before display, but that feels really kludgy and, frankly, it would be nice to be able to do this just using a substitution, if possible.  Is there some way of achieving this that doesn't involve cutting code? If so, is  what is causing the HTML escapes? (The function description reads as though it's only causing the removal of HTML tags, which I am fine with either way — they won't occur in my node titles. I am wanting to stop escaping the HTML escapes, however.)  So how can I (on a specific Content Type, without worrying about security concerns) prevent Node titles from rendering HTML escape characters to the usual and just write the damn output to the page?  I did scan through several pages of similar-looking questions before posting and I couldn't find one that addressed this, so my apologies if someone has asked this already; if you point me towards it I'll be suitably embarrassed and try even harder next time. Thanks for your help, everyone!
61016
I realize that parameterized SQL queries is the optimal way to sanitize user input when building queries that contain user input, but I'm wondering what is wrong with taking user input and escaping any single quotes and surrounding the whole string with single quotes. Here's the code:  sSanitizedInput = "'" &amp; Replace(sInput, "'", "''") &amp; "'"   Any single-quote the user enters is replaced with double single-quotes, which eliminates the users ability to end the string, so anything else they may type, such as semicolons, percent signs, etc., will all be part of the string and not actually executed as part of the command.    We are using Microsoft SQL Server 2000, for which I believe the single-quote is the only string delimiter and the only way to escape the string delimiter, so there is no way to execute anything the user types in.  I don't see any way to launch an SQL injection attack against this, but I realize that if this were as bulletproof as it seems to me someone else would have thought of it already and it would be common practice.    What's wrong with this code? Is there a way to get an SQL injection attack past this sanitization technique?  Sample user input that exploits this technique would be very helpful.    UPDATE:  I still don't know of any way to effectively launch a SQL injection attack against this code. A few people suggested that a backslash would escape one single-quote and leave the other to end the string so that the rest of the string would be executed as part of the SQL command, and I realize that this method would work to inject SQL into a MySQL database, but in SQL&nbsp;Server 2000 the only way (that I've been able to find) to escape a single-quote is with another single-quote; backslashes won't do it.  And unless there is a way to stop the escaping of the single-quote, none of the rest of the user input will be executed because it will all be taken as one contiguous string.  I understand that there are better ways to sanitize input, but I'm really more interested in learning why the method I provided above won't work. If anyone knows of any specific way to mount a SQL injection attack against this sanitization method I would love to see it.
60114
When editing a question with tags which contain accent marks (and likely other non-ASCII characters), the display is garbled, showing HTML escape sequences to the user:    The above screen shot is taken while editing  on my Nexus 4 with Android 5.1.1 viewing the mobile web site (not the Android app).  Although I initially discovered the issue trying to edit  on the pre-private-beta ES.SO (so likely not yet visible to many people).
16238
How do I escape a backtick ` within a code block?  This is probably a duplicate, since I'm sure it's a common concern, but I can't find a question that addresses this specifically.  How do I write List'1 with the "1" character still in the code-text format?
43114
Whenever I'm at the console login, I press up arrow intentionally to see the previously typed commands. But I see this ^[[A.  But when I press Ctrl Alt Print Screen Scroll Lock Pause Break Page Up Page Down Win keys doesn't echo any characters.  What might be the reason behind?  Does ^[[A sort of characters imply anything?
117990
What are the differences between htmlspecialchars() and htmlentities(). When should I use one or the other?
11270
I clicked a tag from a user profile on a site where I don't have an account. The address was:        It then took me to the "nocaptcha" page which I passed (with flying colors) by clicking the magic checkbox. I was then redirected to the search, but with brackets that surrounded the tag removed:        Clearly the brackets should be retained through this captcha detour.
13425
I'm trying to write a blog post which includes a code segment inside a &lt;pre&gt; tag. The code segment includes a generic type and uses &lt;&gt; to define that type. This is what the segment looks like:  &lt;pre&gt;     PrimeCalc calc = new PrimeCalc();     Func&lt;int, int&gt; del = calc.GetNextPrime; &lt;/pre&gt;   The resulting HTML removes the &lt;&gt; and ends up like this:  PrimeCalc calc = new PrimeCalc(); Func del = calc.GetNextPrime;   How do I escape the &lt;&gt; so they show up in the HTML?
123007
We have a high security application and we want to allow users to enter URLs that other users will see.  This introduces a high risk of XSS hacks - a user could potentially enter javascript that another user ends up executing. Since we hold sensitive data it's essential that this never happens.  What are the best practices in dealing with this? Is any security whitelist or escape pattern alone good enough?   Any advice on dealing with redirections ("this link goes outside our site" message on a warning page before following the link, for instance)  Is there an argument for not supporting user entered links at all?    Clarification:  Basically our users want to input:      stackoverflow.com   And have it output to another user:  &lt;a href="http://stackoverflow.com"&gt;stackoverflow.com&lt;/a&gt;   What I really worry about is them using this in a XSS hack. I.e. they input:     alert('hacked!');   So other users get this link:  &lt;a href="javascript:alert('hacked!');"&gt;stackoverflow.com&lt;/a&gt;   My example is just to explain the risk - I'm well aware that javascript and URLs are different things, but by letting them input the latter they may be able to execute the former.  You'd be amazed how many sites you can break with this trick - HTML is even worse. If they know to deal with links do they also know to sanitise &lt;iframe&gt;, &lt;img&gt; and clever CSS references?  I'm working in a high security environment - a single XSS hack could result in very high losses for us. I'm happy that I could produce a Regex (or use one of the excellent suggestions so far) that could exclude everything that I could think of, but would that be enough?
56382
I’m using the listings package for code listings. Now I try to highlight some part of the code using \hl from the soul package.  Here’s an example of a resulting query where the injected part of a SQL injection should be highlighted:  \begin{lstlisting}[escapechar=@,language=SQL] SELECT name, password FROM users WHERE name='@\hl{' UNION SELECT "10", 1 \#}@'; \end{lstlisting}   But inside the highlighted part the SQL syntax highlighting is not applied.  So I tried to use \lstlinline for the code part inside \hl as well but it didn’t work:  \begin{lstlisting}[escapechar=@,language=SQL] SELECT name, password FROM users WHERE name='@\hl{\lstinline[language=SQL]$' UNION SELECT "10", 1 #$}@'; \end{lstlisting}   Although this \lstinline part works outside the lstlisting block, it doesn’t work inside it. The error I get for that particular line is:     Extra }, or forgotten \endgroup.   Maybe I’m just missing just some special syntax to get this working. Or is it not possible at all to get proper syntax highlighting for the \hl-highlighted part as well?
91651
I know that it isn't a new question (I read already some others questions) but:   the question was asked many months ago; my problem, perhaps, is a little different!   Well, as I wrote in the previous message I'm blind and when I try to insert a question I have many problems with correctly indenting my code! I try the shortcut ctrl+K but it add the first 4 spaces and nothing else! If I try to indent this code, for example:  String buf; if(buf!=null) buf="buf isn't null"; else buf="buf is null";   If I selected all rows and press ctrl+K all rows are shifted to right by 4 spaces and the check returns an error because the rows 3 and 5 aren't indentent correctly and now there is the problem... if I select lines 3 and 5 and press ctrl+K again, the editor deletes the 4 spaces!  My question is: why don't you implement an HTML tag (something like &lt;bad code&gt;) that skips the control and, the negative thing, add a "bad reputation" to the author? I don't ask a workaround, but I can't lose 3 hours (yesterday I lost this time) for a question that already I can't post because the code is blocked! Another suggestion: could we be to able ask a moderator to add that bad reputation if he/she see the author never indent his/her code or remove the "bad reputation" if he/she see the author try to indent the code but it isn't indent perfectly! What do you think about it?  P.S.: This post is caused by the frustration that I have because from yesterday to today I can't insert a question on stack overflow because my code isn't indented correctly... If you should see how many times I try to fix it tou could understand my frustration!  P.S.2: can you implement the tag title on your toolbar icon? It could help me to use it.  @Hammar: ok, I write here what I think should be the correct code:     String buf;     if(buf!=null)         buf="buf is not null";     else         buf="buf is null"; ...  There are some errors to this code?  Ok, now I understand that the error wasn't where I thought (or better it COULD be in another place) so my new suggestion is: why don't you create a function that insert a tag for delimited where is the error? I not that you already change the post (for example deleting the initial phrase: "Hello all,") but i don't know how you do the check so I don't know if it is possible!  Ok, now I inset the question that caused this post and my frustration, the question is this:    and I resolve the check adding 4 space around all "suspected" code and adding some empty line... Tell me if it is better change the title for only the last suggestion or is better keep all things for, in the future, understand why and what I asked...
11767
I tried before to post a shell script that contained a ` character as an answer on Stack Overflow. The parser insisted on treating the backtick as formatting instead of part of code.  How can I include it?
37436
I'm using  to check if a user-provided email address is valid. For example:  $email = $_POST['email']; if ( is_email( $email ) )     // Do something.   To the best of my knowledge, nothing in this function writes info to the database. Should I be sanitizing $email before I pass it to the function?