Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

why is $first_name variable different in echo, mysql, fwrite

Posted on 2013-01-18
5
Medium Priority
?
386 Views
Last Modified: 2013-01-18
why is $first_name variable different in echo, mysql, fwrite

echo $first_name is
 Ray

mysql $first_name is
 Ray <ray.paseur@gmail.com>

fwrite $first_name is
 Ray <ray.paseur@gmail.com>


the only way I can put
Ray as the $first_name in mysql database is if I copy paste the echo (not fwrite)

  $cols = array(
"first_name",
"email1",
"description"
);

 
// FROM THE POST AT EE
function emailregex($str)
{
    // A REGULAR EXPRESSION TO FIND THE FROM-EMAIL ADDRESS
    $regex
    = '#'         // REGEX DELIMITER
    . '.*?'       // ANYTHING OR NOTHING
    . '\<'        // ESCAPED WICKET
    . '(.*?)'     // GROUP OF CHARACTERS WITH EMAIL ADDRESS
    . '\>'        // ESCAPED WICKET
    . '#'         // REGEX DELIMITER
    ;


    // ISOLATE THE FROM EMAIL ADDRESS
    preg_match($regex, $str, $matches);
    return $matches;
} 




$from = emailregex(" Ray <ray.paseur@gmail.com>");
  
$email1=$from[1];  
$first_name=$from[0];

           $q = 'INSERT INTO '.$tablename.' (';
        foreach ($cols as &$columnname) {
          $q.=$columnname.',';
          }        
        $q=rtrim($q, ",");
        $q.=') VALUES (';
        foreach ($cols as &$columnname) {
        $q.='\''.mysql_real_escape_string($$columnname).'\',';        
        }
        $q=substr_replace($q, "", -1);
        $q.=')';
        echo '<br>'.$q;
        echo fwrite($fwritefile,$q);
        mysql_query ($q);
?>

Open in new window

0
Comment
Question by:rgb192
  • 2
  • 2
5 Comments
 
LVL 143

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 38792968
>echo $first_name is

will output that value, the the "<"  is starting a html tag. you need to use "htmlentities" on the variable to output it correctly to "html" output
http://php.net/manual/en/function.htmlentities.php
echo htmlentities($first_name);
0
 
LVL 111

Expert Comment

by:Ray Paseur
ID: 38793037
To add to what angelIII has (wisely) suggested, please be aware that you create a gigantic security problem for your clients if your scripts ever echo any data without using htmlentities().  To illustrate this issue, run the following code.  If your script accepts external input from any source, be it forms, data base results, cookies, etc. you MUST escape the output before sending it to the client browser.

Also, learn to use the "view source" feature of your browser.  It's often quite illuminating!

<?php // RAY_temp_rgb192.php

// A SIMULATED ATTACK VECTOR
$evil = <<<JAVASCRIPT
<script type="text/javascript">
alert("I JUST REDIRECTED YOUR BROWSER TO AN ATTACK SITE AND ALL YOU CAN DO IS CLICK OK, SUCKER");
</script>
JAVASCRIPT;

// DANGEROUS
echo $evil;

// SAFE
echo htmlentities($evil);

Open in new window

0
 

Author Comment

by:rgb192
ID: 38793336
echo htmlentities($first_name);

echos output
 Ray <ray.paseur@gmail.com>

want
Ray

function emailregex($str)  is
name as part[0]
and
email part[1]


and thanks Ray for teaching me about htmlentities security
0
 
LVL 111

Accepted Solution

by:
Ray Paseur earned 2000 total points
ID: 38793373
I think PHP strip_tags() might be what you want.  And maybe trim().

<?php // RAY_temp_rgb192.php

$str = ' Ray <ray.paseur@gmail.com>';
$new = trim(strip_tags($str));

echo '<pre>';
echo htmlentities($str);
echo PHP_EOL;
echo htmlentities($new);

Open in new window

0
 

Author Closing Comment

by:rgb192
ID: 38793472
now output is Ray

thanks
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Containers like Docker and Rocket are getting more popular every day. In my conversations with customers, they consistently ask what containers are and how they can use them in their environment. If you’re as curious as most people, read on. . .
In this blog post, we’ll look at how using thread_statistics can cause high memory usage.
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to dynamically set the form action using jQuery.
Suggested Courses

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question