why is $first_name variable different in echo, mysql, fwrite

why is $first_name variable different in echo, mysql, fwrite

echo $first_name is
Ray

mysql $first_name is
Ray <ray.paseur@gmail.com>

fwrite $first_name is
Ray <ray.paseur@gmail.com>

the only way I can put
Ray as the $first_name in mysql database is if I copy paste the echo (not fwrite)

  $cols = array(
"first_name",
"email1",
"description"
);

 
// FROM THE POST AT EE
function emailregex($str)
{
    // A REGULAR EXPRESSION TO FIND THE FROM-EMAIL ADDRESS
    $regex
    = '#'         // REGEX DELIMITER
    . '.*?'       // ANYTHING OR NOTHING
    . '\<'        // ESCAPED WICKET
    . '(.*?)'     // GROUP OF CHARACTERS WITH EMAIL ADDRESS
    . '\>'        // ESCAPED WICKET
    . '#'         // REGEX DELIMITER
    ;


    // ISOLATE THE FROM EMAIL ADDRESS
    preg_match($regex, $str, $matches);
    return $matches;
} 




$from = emailregex(" Ray <ray.paseur@gmail.com>");
  
$email1=$from[1];  
$first_name=$from[0];

           $q = 'INSERT INTO '.$tablename.' (';
        foreach ($cols as &$columnname) {
          $q.=$columnname.',';
          }        
        $q=rtrim($q, ",");
        $q.=') VALUES (';
        foreach ($cols as &$columnname) {
        $q.='\''.mysql_real_escape_string($$columnname).'\',';        
        }
        $q=substr_replace($q, "", -1);
        $q.=')';
        echo '<br>'.$q;
        echo fwrite($fwritefile,$q);
        mysql_query ($q);
?>

Open in new window

LVL 1

rgb192Asked: 2013-01-18

Who is Participating?

LVL 111

Ray PaseurCommented: 2013-01-18

I think PHP strip_tags() might be what you want. And maybe trim().

<?php // RAY_temp_rgb192.php

$str = ' Ray <ray.paseur@gmail.com>';
$new = trim(strip_tags($str));

echo '<pre>';
echo htmlentities($str);
echo PHP_EOL;
echo htmlentities($new);

Open in new window

LVL 143

Guy Hengel [angelIII / a3]Billing EngineerCommented: 2013-01-18

>echo $first_name is

will output that value, the the "<" is starting a html tag. you need to use "htmlentities" on the variable to output it correctly to "html" output
http://php.net/manual/en/function.htmlentities.php
echo htmlentities($first_name);

LVL 111

Ray PaseurCommented: 2013-01-18

To add to what angelIII has (wisely) suggested, please be aware that you create a gigantic security problem for your clients if your scripts ever echo any data without using htmlentities(). To illustrate this issue, run the following code. If your script accepts external input from any source, be it forms, data base results, cookies, etc. you MUST escape the output before sending it to the client browser.

Also, learn to use the "view source" feature of your browser. It's often quite illuminating!

<?php // RAY_temp_rgb192.php

// A SIMULATED ATTACK VECTOR
$evil = <<<JAVASCRIPT
<script type="text/javascript">
alert("I JUST REDIRECTED YOUR BROWSER TO AN ATTACK SITE AND ALL YOU CAN DO IS CLICK OK, SUCKER");
</script>
JAVASCRIPT;

// DANGEROUS
echo $evil;

// SAFE
echo htmlentities($evil);

Open in new window

LVL 1

rgb192Author Commented: 2013-01-18

echo htmlentities($first_name);

echos output
Ray <ray.paseur@gmail.com>

want
Ray

function emailregex($str) is
name as part[0]
and
email part[1]

and thanks Ray for teaching me about htmlentities security