Welcome! » Log In » Create A New Profile

why aren't single quotes turned into '?

Posted by Roly 
Forum List Message List New Topic
Roly
why aren't single quotes turned into '?
June 11, 2009 12:00AM

Wouldn't you agree that most of which is purified through HTML purifier gets put in a database? SQL queries can easily be injected if single quotes aren't escaped. So why isn't this something HTML Purifier offers? It even converts ' back into '. Why? It even does it with the doctype changed to XHTML 1.1. I have to put str_replace('\'', ''', $text) after $text goes through the purifier.

Reply Quote
Ambush Commander
Re: why aren't single quotes turned into '?
June 11, 2009 12:37AM

HTML Purifier normalizes characters into a common, safe form, in order to improve the uniformity of its output. A regular single quote is much prettier than the numeric character entity reference.

With regards to SQL injections, HTML Purifier is not and cannot be in any way related to your database. You must use an appropriate SQL escaping command.

Reply Quote
FunkyRes
Re: why aren't single quotes turned into '?
June 27, 2009 08:59AM

Use prepared sql statements and sql injection really isn't a problem.

http://dev.mysql.com/tech-resources/articles/4.1/prepared-statements.html

I personally do it via pear::mdb2 but I believe you can also do it with pdo and even the raw mysql driver.

Reply Quote
Timothy (TRiG)
Re: why aren't single quotes turned into '?
January 05, 2010 04:06PM

Database escaping is a different problem altogether. I use mysql_real_escape_string() (though I'm currently reading the mysqli documentation and trying to work out whether I should switch).

TRiG.

Reply Quote
Newer Topic Older Topic
Author:
Your Email:

Subject:

HTML input is enabled. Make sure you escape all HTML and angled brackets with < and >.

Auto-paragraphing is enabled. Double newlines will be converted to paragraphs; for single newlines, use the pre tag.

Allowed tags: a, abbr, acronym, b, blockquote, caption, cite, code, dd, del, dfn, div, dl, dt, em, i, ins, kbd, li, ol, p, pre, s, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, var.

For inputting literal code such as HTML and PHP for display, use CDATA tags to auto-escape your angled brackets, and pre to preserve newlines: 

<pre><![CDATA[
Place code here
]]></pre>

Power users, you can hide this notice with: 

.htmlpurifier-help {display:none;}

Message: