Solved

header fails parsing htmlspecialchars

Posted on 2004-05-02
5
184 Views
Last Modified: 2008-02-01
I'm making a search engine which has some extra inputfields (order by, searching for name and/or searching for the text)

see the $_GET array:
f is an array, this array will be changed by the function below to f=n|i|b
s isn't changed
o isn't changed
q is the query <-- this is where the problem is!

the address: http://recepten/?act=search&f%5Bn%5D=true&f%5Bi%5D=true&f%5Bb%5D=true&s=n&o=asc&q=%26
$_GET: Array ( [act] => search [f] => Array ( [n] => true [i] => true [b] => true ) [s] => n [o] => asc [q] => & )

$_GET["q"] = addslashes(htmlentities($_GET["q"]));
if (is_array($_GET["f"])) {
      foreach ($_GET["f"] as $key => $value) {
            $_GET["f"][] = $key;
            unset($_GET["f"][$key]);
      }
      $_GET["f"] = implode("|", $_GET["f"]);
      foreach ($_GET as $key => $value) {
            if ($key != "act") {
                  $href .= "&".$key."=".$value;
            }
      }
      $href = '?act=search'.$href;
      header("Location: ".$href);
      exit();
}

after this function the $_GET array should be: Array ( [act] => search [f] => n|i|b [s] => n [o] => asc [q] => & )
and the address: http://recepten/?act=search&f=n|i|b&s=n&o=asc&q=%26

but,

the address is this: http://recepten/?act=search&f=n|i|b&s=n&o=asc&q=&amp; <-- the %26 is changed to &amp;
it seems quite logical, but I must keep the %26 or else you know what will happen when someone searches for something like &act=something

before the header is send, $href is (already) ?act=search&f=n|i|b&s=n&o=asc&q=&amp;

how can I make it so that the %26 isn't changed to &amp;?
0
Comment
Question by:nemesis3884
5 Comments
 
LVL 14

Expert Comment

by:cracky
ID: 10972086
Have you tried removing the htmlentities() function from your code?

It is this that's converting %26 to &.

Since the string you get in the page is already URL encoded, there is no need to encode it with htmlentities() at all.

If you really want to use htmlentities(), just call html_entitity_decode() when outputting the string again like so:

$_GET["q"] = addslashes(htmlentities($_GET["q"]));
if (is_array($_GET["f"])) {
     foreach ($_GET["f"] as $key => $value) {
          $_GET["f"][] = $key;
          unset($_GET["f"][$key]);
     }
     $_GET["f"] = implode("|", $_GET["f"]);
     foreach ($_GET as $key => $value) {
          if ($key != "act") {
               $href .= "&".$key."=".$value;
          }
     }
     $href = '?act=search'.html_entitity_decode($href);
     header("Location: ".$href);
     exit();
}

Bear in mind that people can still manipulate your querystring whether you like it or not, so make sure you don't let the querystring have a lot of impact on your script, or people will soon work out how to play with it.
0
 
LVL 1

Author Comment

by:nemesis3884
ID: 10972579
both the things you mentioned didn't work, but I think i've found the solution

I'm now using urlencode:

unset($_GET["order"]);
if (is_array($_GET["f"])) {
      foreach ($_GET["f"] as $key => $value) {
            $_GET["f"][] = $key;
            unset($_GET["f"][$key]);
      }
      $_GET["f"] = implode("|", $_GET["f"]);
      foreach ($_GET as $key => $value) {
            if ($key != "act") {
                  if ($key == "q") {
                        $value = urlencode(stripslashes($value));
                  }
                  $href .= "&".$key."=".$value;
            }
      }
      $href = '?act=search'.$href;
      header("Location: ".$href);
      exit();
}

this seems to be working, off course I also use htmlspecialchars to keep the html-like input away ;)
0
 
LVL 26

Expert Comment

by:skullnobrains
ID: 10976069
<just a note>
if you need something near to secure, the FIRST character to strip is '|' so you of course had better not using it yourself. you may even manage to fool your own code with a bit of rotten luck.

what is the point of having a temporary page ? couldn't you perform the search on the same page, and then both html and messy redirects with headers won't be an issue ?
</note>
0
 

Accepted Solution

by:
modulo earned 0 total points
ID: 11702198
Closed, 500 points refunded.

modulo
Community Support Moderator
Experts Exchange
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Popularity Can Be Measured Sometimes we deal with questions of popularity, and we need a way to collect opinions from our clients.  This article shows a simple teaching example of how we might elect a favorite color by letting our clients vote for …
Part of the Global Positioning System A geocode (https://developers.google.com/maps/documentation/geocoding/) is the major subset of a GPS coordinate (http://en.wikipedia.org/wiki/Global_Positioning_System), the other parts being the altitude and t…
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …

948 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now