Question

I am beginner in web development, I am developing a site that allows user to post various discussions and others comment and reply on it. The problem I am facing is, the user can post almost anything, including code snippets and any other thing which might possible include single quotes, double quotes and even some html content.

When such posts are being posted, it is intervening with the MySQL insert query as the quotes are ending the string and as a result the query is failing. And even when I display the string using php, the string is being interpreted as html by the browser, where as I want it to be interpreted as text. Do I have to parse the input string manually and escape all the special characters? or is there another way?

Answer 1

To avoid the breaking of queries in database (which means you’re not escaping them, leaving big holes for sql injection) you use mysql_real_escape_string($string) on the value before passing it to the query string, enclosing it in quotes also.

Ex. $value = mysql_real_escape_string($value);  // be sure to have an open connection before using this function.
$query = "select * from `table` where value = '".$value."'";

As for displaying in html, you should at least echo htmlentities($string) before outputting it to the browser.

Like echo htmlentities($mystring, ENT_QUOTES)`;

Edit:

To preserve withe spaces, you can use nl2br function (which converts linebrakes to the html equivalen <br />) or go for a little deeper $string = nl2br(str_replace(" ", "  ", $string));, but html code would look a bit ugly, at least for me

Reference: htmlentities and mysql_real_escape_string. nl2br