Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

why is $first_name variable different in echo, mysql, fwrite

Posted on 2013-01-18
5
368 Views
Last Modified: 2013-01-18
why is $first_name variable different in echo, mysql, fwrite

echo $first_name is
 Ray

mysql $first_name is
 Ray <ray.paseur@gmail.com>

fwrite $first_name is
 Ray <ray.paseur@gmail.com>


the only way I can put
Ray as the $first_name in mysql database is if I copy paste the echo (not fwrite)

  $cols = array(
"first_name",
"email1",
"description"
);

 
// FROM THE POST AT EE
function emailregex($str)
{
    // A REGULAR EXPRESSION TO FIND THE FROM-EMAIL ADDRESS
    $regex
    = '#'         // REGEX DELIMITER
    . '.*?'       // ANYTHING OR NOTHING
    . '\<'        // ESCAPED WICKET
    . '(.*?)'     // GROUP OF CHARACTERS WITH EMAIL ADDRESS
    . '\>'        // ESCAPED WICKET
    . '#'         // REGEX DELIMITER
    ;


    // ISOLATE THE FROM EMAIL ADDRESS
    preg_match($regex, $str, $matches);
    return $matches;
} 




$from = emailregex(" Ray <ray.paseur@gmail.com>");
  
$email1=$from[1];  
$first_name=$from[0];

           $q = 'INSERT INTO '.$tablename.' (';
        foreach ($cols as &$columnname) {
          $q.=$columnname.',';
          }        
        $q=rtrim($q, ",");
        $q.=') VALUES (';
        foreach ($cols as &$columnname) {
        $q.='\''.mysql_real_escape_string($$columnname).'\',';        
        }
        $q=substr_replace($q, "", -1);
        $q.=')';
        echo '<br>'.$q;
        echo fwrite($fwritefile,$q);
        mysql_query ($q);
?>

Open in new window

0
Comment
Question by:rgb192
  • 2
  • 2
5 Comments
 
LVL 143

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 38792968
>echo $first_name is

will output that value, the the "<"  is starting a html tag. you need to use "htmlentities" on the variable to output it correctly to "html" output
http://php.net/manual/en/function.htmlentities.php
echo htmlentities($first_name);
0
 
LVL 109

Expert Comment

by:Ray Paseur
ID: 38793037
To add to what angelIII has (wisely) suggested, please be aware that you create a gigantic security problem for your clients if your scripts ever echo any data without using htmlentities().  To illustrate this issue, run the following code.  If your script accepts external input from any source, be it forms, data base results, cookies, etc. you MUST escape the output before sending it to the client browser.

Also, learn to use the "view source" feature of your browser.  It's often quite illuminating!

<?php // RAY_temp_rgb192.php

// A SIMULATED ATTACK VECTOR
$evil = <<<JAVASCRIPT
<script type="text/javascript">
alert("I JUST REDIRECTED YOUR BROWSER TO AN ATTACK SITE AND ALL YOU CAN DO IS CLICK OK, SUCKER");
</script>
JAVASCRIPT;

// DANGEROUS
echo $evil;

// SAFE
echo htmlentities($evil);

Open in new window

0
 

Author Comment

by:rgb192
ID: 38793336
echo htmlentities($first_name);

echos output
 Ray <ray.paseur@gmail.com>

want
Ray

function emailregex($str)  is
name as part[0]
and
email part[1]


and thanks Ray for teaching me about htmlentities security
0
 
LVL 109

Accepted Solution

by:
Ray Paseur earned 500 total points
ID: 38793373
I think PHP strip_tags() might be what you want.  And maybe trim().

<?php // RAY_temp_rgb192.php

$str = ' Ray <ray.paseur@gmail.com>';
$new = trim(strip_tags($str));

echo '<pre>';
echo htmlentities($str);
echo PHP_EOL;
echo htmlentities($new);

Open in new window

0
 

Author Closing Comment

by:rgb192
ID: 38793472
now output is Ray

thanks
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I imagine that there are some, like me, who require a way of getting currency exchange rates for implementation in web project from time to time, so I thought I would share a solution that I have developed for this purpose. It turns out that Yaho…
Part of the Global Positioning System A geocode (https://developers.google.com/maps/documentation/geocoding/) is the major subset of a GPS coordinate (http://en.wikipedia.org/wiki/Global_Positioning_System), the other parts being the altitude and t…
The viewer will learn how to dynamically set the form action using jQuery.
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.

791 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question