My problem is. I have an input on HTML code which receives the users text. That could be  just an "example" of an entry (on the input);   So, I need to convert that special caracters ", (, ), ', ' to the special codes   I'm trying to use php function str_replace to swap the caracters with the code, but when I do that the new string keep the caracters instead of the code. Is there any way to convert those caracters to use them on a sql insert/update without errors?  I hope that edit help a little. Sorry about my english.
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
25790
When I try to send a HTML encoded email from PHP, if the subject line contains special chars like "Here's the information you requested", PHP encodes it to read "Here&amp;#039;s the information you requested."  How do I fix this?    Here's what the code looks like using PHP mail():  $headers  = 'MIME-Version: 1.0' . "\r\n"; $headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";  $headers .= 'To: ' . $mod_params['name'] . '&lt;' . $mod_params['email'] . '&gt;' . "\r\n";  $headers .= 'From: &lt;do_not_reply@a4isp.com&gt;' . "\r\n";    $email_to = $mod_params['email'];  $email_sub = "Here's the Information You Requested";  $body = html_entity_decode("&lt;html&gt;&lt;body&gt;" . $email_html_body . "&lt;/body&gt;&lt;/html&gt;");  mail($email_to,$email_sub,$body,$headers);   It gives the same error as running it through the SugarPHPMailer class.
48505
Is there a way to do character translation / transliteration (kind of like the tr command) using Python?  Some examples in Perl would be:  my $string = "some fields"; $string =~ tr/dies/eaid/; print $string;  # domi failed  $string = 'the cat sat on the mat.'; $string =~ tr/a-z/b/d; print "$string\n";  # b b   b.  (because option "d" is used to delete characters not replaced)
47388
In C#, can I convert a string value to a string literal, the way I would see it in code? I would like to replace tabs, newlines, etc. with their escape sequences. If this code: Console.WriteLine(someString);  produces: Hello World!  I want this code: Console.WriteLine(ToLiteral(someString));  to produce: \tHello\r\n\tWorld!\r\n
47610
This has been confusing me for some time. With the advent of UTF-8 as the de-facto standard in web development I'm not sure in which situations I'm supposed to use the HTML entities and for which ones should I just use the UTF-8 character. For example,   em dash (–, &amp;emdash;) ampersand (&amp;, &amp;amp;) 3/4 fraction (¾, &amp;frac34;)   Please do shed light on this issue. It will be appreciated.
37436
I'm using  to check if a user-provided email address is valid. For example:  $email = $_POST['email']; if ( is_email( $email ) )     // Do something.   To the best of my knowledge, nothing in this function writes info to the database. Should I be sanitizing $email before I pass it to the function?
103530
I'm wondering if there is a "best" choice for collation in MySQL for a general website where you aren't 100% sure of what will be entered? I understand that all the encodings should be the same, such as MySQL, Apache, the HTML and anything inside PHP.  In the past I have set PHP to output in "UTF-8", but which collation does this match in MySQL? I'm thinking it's one of the UTF-8 ones, but I have used utf8_unicode_ci, utf8_general_ci, and utf8_bin before.
91416
What is the easiest way to highlight the difference between two strings in PHP?  I'm thinking along the lines of the Stack Overflow edit history page, where new text is in green and removed text is in red. If there are any pre-written functions or classes available, that would be ideal.
14196
I realize that CHAR is recommended if all my values are fixed-width. But, so what? Why not just pick VARCHAR for all text fields just to be safe.
27528
I am looking for a way to pull the first 100 characters from a string variable to put in another variable for printing.    Is there a function that can do this easily?  For example:  $string1 = "I am looking for a way to pull the first 100 characters from a string variable to put in another variable for printing."; $string2 = 100charfunction($string1); print $string2   To get:  I am looking for a way to pull the first 100 characters from a string vari
20412
I was looking for a generic method in .Net to encode a string for use in an Xml element or attribute, and was surprised when I didn't immediately find one.  So, before I go too much further, could I just be missing the built-in function?    Assuming for a moment that it really doesn't exist, I'm putting together my own generic EncodeForXml(string data) method, and I'm thinking about the best way to do this.    The data I'm using that prompted this whole thing could contain bad characters like &amp;, &lt;, &quot;, etc.  It could also contains on occasion the properly escaped entities: &amp;amp;, &amp;lt;, and &amp;quot;, which means just using a CDATA section may not be the best idea.  That seems kinda klunky anyay; I'd much rather end up with a nice string value that can be used directly in the xml.  I've used a regular expression in the past to just catch bad ampersands, and I'm thinking of using it to catch them in this case as well as the first step, and then doing a simple replace for other characters.    So, could this be optimized further without making it too complex, and is there anything I'm missing? :  Function EncodeForXml(ByVal data As String) As String     Static badAmpersand As new Regex("&amp;(?![a-zA-Z]{2,6};|#[0-9]{2,4};)")      data = badAmpersand.Replace(data, "&amp;amp;")      return data.Replace("&lt;", "&amp;lt;").Replace("""", "&amp;quot;").Replace("&gt;", "gt;") End Function   Sorry for all you C# -only folks-- I don't really care which language I use, but I wanted to make the Regex static and you can't do that in C# without declaring it outside the method, so this will be VB.Net  Finally, we're still on .Net 2.0 where I work, but if someone could take the final product and turn it into an extension method for the string class, that'd be pretty cool too.  Update The first few responses indicate that .Net does indeed have built-in ways of doing this.  But now that I've started, I kind of want to finish my EncodeForXml() method just for the fun of it, so I'm still looking for ideas for improvement.  Notably: a more complete list of characters that should be encoded as entities (perhaps stored in a list/map), and something that gets better performance than doing a .Replace() on immutable strings in serial.
13602
I'm looking for the alternative of mysql_real_escape_string() for SQL Server. Is addslashes() my best option or there is another alternative function that can be used?  An alternative for mysql_error() would also be useful.
39900
I have the following string:  "Look on http://www.google.com".   I need to convert it to:     "Look on "   The original string can have more than 1 URL string.  How do I do this in php?  Thanks
89192
I have some HTML I am trying to parse.  There are cases where the html attributes alone are not going to help me identify the row type (header versus data).  Fortunately, if my row is a data row then it should have some values that can be converted to integers.  I have figured out how to convert the unicode to an integer for those cases that it is possible to make the conversion.  I am struggling to write the logic to move past the cells that the conversion will not work because the cell has content that must be treated as text.  for example if rowColumn[1][3] can be converted to an integer I can do so by   int(rowColumn[1][3].replace(',','').strip('$'))   but I get an error if rowColumn[1][3] has text content.
13909
When encoding a query string to be sent to a web server - when do you use escape() and when do you use encodeURI() or encodeURIComponent():  Use escape:  escape("% +&amp;=");   OR  use encodeURI() / encodeURIComponent()  encodeURI("http://www.google.com?var1=value1&amp;var2=value2");  encodeURIComponent("var1=value1&amp;var2=value2");
3752
I have PHP configured so that magic quotes are on and register globals are off.  I do my best to always call htmlentities() for anything I am outputing that is derived from user input.  I also occasionally seach my database for common things used in xss attached such as...  &lt;script   What else should I be doing and how can I make sure that the things I am trying to do are always done.
78486
For example, if I have a unicode string, I can encode it as an ASCII string like so:  &gt;&gt;&gt; u'\u003cfoo/\u003e'.encode('ascii') '&lt;foo/&gt;'   However, I have e.g. this ASCII string:  '\u003foo\u003e'   ... that I want to turn into the same ASCII string as in my first example above:  '&lt;foo/&gt;'