mysql_real_escape_string not working?

Question

I'm trying to secure the data users submit via forms on my website so they cannot submit data in HTML. I am trying the following but when I test it, I'm still able to submit HTML data and it writes to the DB just as I entered and displays the HTML when I read from the DB.

if (isset($_POST['submit'])) {

    if ( strlen($_POST['topictitle']) < 10 ) {
        $errors .= "<div>You topic title must be 10 characters or longer!</div>";
    } else {
        $thread_title = mysqli_real_escape_string($db_connect, trim($_POST['topictitle']));
    }

    if ( strlen($_POST['content']) < 10 ) {
        $errors .= "<div>You message must be 10 characters or longer!</div>";
    } else {
        $content = mysqli_real_escape_string($db_connect, $_POST['content']);
    }

    if (isset($errors)) {
        $error_message = "<div class=\"error_box\">$errors</div>";
        $smarty->assign ('error_message', $error_message);
    } else {
        $thread_sql = "
            INSERT INTO forum_threads (
                user_id,
                forum_id,
                thread_postdate,
                thread_lastpost,
                thread_title,
                thread_description,
                thread_icon
            ) VALUES (
                '$_SESSION[user_id]',
                '$_GET[f]',
                '$date',
                '$date',
                '$thread_title',
                IF('$_POST[topicdescription]'='',NULL,'$_POST[topicdescription]'),
                IF('$_POST[posticon]'='NULL',NULL,'$_POST[posticon]')
            )
        ";
        $thread_query = @mysqli_query ($db_connect, $thread_sql);

        $select_thread_sql = "
            SELECT
                thread_id
            FROM
                forum_threads
            WHERE
                thread_id = LAST_INSERT_ID()
        ";
        $select_thread_query = @mysqli_query ($db_connect, $select_thread_sql);
        $select_thread = mysqli_fetch_assoc($select_thread_query);

        $thread_id = $select_thread['thread_id'];

        $post_sql = "
            INSERT INTO forum_posts (
                user_id,
                thread_id,
                post_message,
                post_date
            ) VALUES (
                '$_SESSION[user_id]',
                '$thread_id',
                '$content',
                '$date'
            )
        ";
        $post_query = @mysqli_query ($db_connect, $post_sql);

        $url = $url . "forum.php?t=" . $thread_id;
        header("Location: $url");
        exit();
    }
}

Ben · Accepted Answer · 2010-11-04 18:37:04Z

3

mysqli_real_escape_string is not meant to escape HTML tags, only prevent against SQL injection by other means. If you want to prevent HTML from being implemented look at strip_tags or htmlentities

answered Nov 4, 2010 at 18:37

Ben

62.7k117 gold badges330 silver badges505 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Pekka Over a year ago

+1 however, only htmlentities() provides full security against XSS attacks, strip_tags() alone won't cut it

mario Over a year ago

strip_tags is sufficient unless you put strings in attributes. And htmlentities is only 'safe' if used with ENT_QUOTES.

Collectives™ on Stack Overflow

mysql_real_escape_string not working?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related