Questions about htmlspecialchars + stripslashes

Worker Joined: Aug 06, 2004 Posts: 192

Does the follow code so the same thing? Just wanted to be sure. Thanks.

Code:

$quote = str_replace("\'","''",$quote);


$quote = preg_replace(array('#&(?!(\#[0-9]+;))#', '#<#', '#>#'), array('&amp;', '&lt;', '&gt;'),$quote);

Code:

$quote = htmlspecialchars(stripslashes($quote));

Posted: Thu Feb 24, 2005 12:15 pm

The function ya_fixtext() in CNB YA uses a replace like that and it causes problems on some servers in with php in CGI mode no matter what the magic quotes are on/off.

What we are going to do instead in the next version is add 2 functions that test for the magic quotes on/off and if off addslashes or stripslashes depending on what we're doing.

Code:




/* This should be run on every non int val returned from the db */


   function CNBYA_stripslashes($var) {


   if ( !get_magic_quotes_gpc() ) {


      return( stripslashes($var) );


   } else {


      return $var;


   }


}





/* This should be run on every non int val saved to the db */


/* it is run in ya_fixtext automatically */


function CNBYA_addslashes($var) {


   if ( !get_magic_quotes_gpc() ) {


      return( addslashes($var) );


   } else {


      return $var;


   }


}

I think we've run into about 3 people who were affected by this so far but it was very frustrating for those 3 people.

Posted: Thu Feb 24, 2005 12:42 pm

Yeah I get confused by these things sometimes.

I was once told that:

Code:

$var = str_replace("\'","''",$var); 


$var = preg_replace(array('#&(?!(\#[0-9]+;))#', '#<#', '#>#'), array('&amp;', '&lt;', '&gt;'),$var);

Is a security thing to check user input.

However I see that phpbb uses code similar to this when the user inputs data in there profile and other places:

Code:

$var = htmlspecialchars(stripslashes($var));

I think the preg_replace and the htmlspecialchars do the same thing, but I am not sure about the rest.

So I was just wondering if these two sets of code do the same thing.

Posted: Thu Feb 24, 2005 1:11 pm

Yes and probably faster or no one would bother.