php escaping user input to display in html

Question

php page1 --> below bit is pure html:

<form action="page2.php" method="post">
<input type="text" name="name" id="name">
-----------submit button, end form --etc.--------------

php page2 (and yes i have intended to stuff the text input from page1 into a hidden input in page2):

foreach($_REQUEST as $key=>$value) 
{
     $value = htmlspecialchars(strip_tags(stripslashes($value))); //attempt to cleanse the data before displaying
}
echo "<p><input type='hidden' id='name' name='name' value='".$_REQUEST['name']."'/>".$_REQUEST['name']."</p>";

The problem is that the output on page 2 is not producing w3 compliant html if the user enters input with quotes such as John O'Brien, the html becomes:

<p><input type='hidden' id='email' name='email' value='John O'Brien'/>John O'Brien</p>

I would also like to be able to produce w3 compliant html for any bad input data such as: j'o/h\n s"m,ith

Any help is appreciated!

Surround attribute values with double quotes " instead of single quotes '. Then all you need is htmlspecialchars — Rudie
– Rudie, Commented Apr 24, 2011 at 13:35

Michael Berkowski · Accepted Answer · 2011-04-24 13:11:33Z

2

Use the ENT_QUOTES option to htmlspecialchars():

$value = htmlspecialchars(strip_tags(stripslashes($value)), ENT_QUOTES);

answered Apr 24, 2011 at 13:11

Michael Berkowski

271k47 gold badges450 silver badges395 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Richard JP Le Guen · Accepted Answer · 2011-04-24 13:25:21Z

0

Personally, I wouldn't use $_REQUEST - the book Essential PHP Security by Chris Shifflet suggests that this could make your application vulnerable to CSRF attacks.

Next, depending on server configuration, you may not have to call stripslashes(...) - see the magic_quotes_gc ini configuration. I'd use the get_magic_quotes_gpc() to determine if it is necessary.

foreach($_REQUEST as $key=>$value) {
    if(get_magic_quotes_gpc()) {
        $value = stripslashes($value);
    }
     $value = htmlspecialchars(strip_tags($value));
}
echo "<p><input type='hidden' id='name' name='name' value='".$_REQUEST['name']."'/>".$_REQUEST['name']."</p>";

answered Apr 24, 2011 at 13:25

Richard JP Le Guen

28.8k8 gold badges93 silver badges121 bronze badges

1 Comment

Your Common Sense Over a year ago

errrr... what's the point in adding slashes right after you stripped it out?

oucil · Accepted Answer · 2015-12-30 21:31:46Z

0

foreach($_REQUEST as &$value) 
{
     $value = addslashes(htmlspecialchars(strip_tags($value)));
}
echo "<p><input type='hidden' id='name' name='name' value='".$_REQUEST['name']."'/>".$_REQUEST['name']."</p>";

edited Dec 30, 2015 at 21:31

oucil

4,6644 gold badges42 silver badges60 bronze badges

answered Apr 24, 2011 at 13:17

DJafari

13.6k8 gold badges46 silver badges69 bronze badges

3 Comments

Michael Berkowski Over a year ago

For my information, is that valid HTML to use backslash-escaped quotes in attributes? It renders in Chrome, but I don't think I've ever seen that before.

DJafari Over a year ago

It's Valid ! I'm Tested it in all browsers

thirdender Over a year ago

This code won't work… The value of the $value variable will only be set inside for foreach loop, and won't change in the original $_REQUEST array (as is the apparent intent). It would be possible to make the code work by passing $value as a reference, or by explicitly setting $_REQUEST[$key] = …. However, this is just bad form… Modifying the entire $_REQUEST array when it might be used by later code is a bad idea.

Your Common Sense · Accepted Answer · 2011-04-25 15:45:58Z

-1

First of all, not your code, nor any of ones posted above will ever work. For the very silly reason.
Next, I am kinda fixated on preserving user input exactly as is. Why delete something might be important?
Third, hidden values should be urlencoded I believe, rather than htmlencoded

so

$FORM = array();
foreach($_POST as $key =>$value) {
    if(get_magic_quotes_gpc()) {
        $value = stripslashes($value);
    }
    $FORM[$key] = htmlspecialchars($value,ENT_QUOTES);
}
echo "<p><input type='hidden' id='name' name='name' value='".$FORM['name']."'/>".
          $FORM['name'].
     "</p>";

edited Apr 25, 2011 at 15:45

answered Apr 24, 2011 at 13:32

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

1 Comment

toop Over a year ago

awesome this is a correct solution, this was what i was after!

Collectives™ on Stack Overflow

php escaping user input to display in html

4 Answers 4

Comments

1 Comment

3 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

3 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related