htmlspecialchars / mySQL

Help!

[PeteM]

I'm taking an input value as follows.....

$category = htmlspecialchars($HTTP_GET_VARS['category']);

The value of $HTTP_GET_VARS['category']is "Cat > 1".
$category is set to "Cat $gt; 1"

I'm storing it on a mySQL database table as an index column then attempting to retrieve it again using the following code and query.....

$category = htmlspecialchars($HTTP_GET_VARS['category']);

"SELECT * FROM categories WHERE cat_category = '$category'";

Using phpMySQLadmin I can see that the row has been correctly created with an index value of "Cat $gt; 1".

However, when I run the select I get a row not found error with the following error message.....

DEBUG MODE

SELECT * FROM categories WHERE cat_category = 'Cat $gt; 1'

What am I doing wrong?

Thanks, as ever, Pete

[PeteM]

Just noticed typos in the above.

For '$gt;' read '>'

Pete

[khaki monster]

HI! newbie here :)

given in your statemenst $category as = "Cat $gt; 1" and run with htmlspecialchars(); that will be translated as "Cat &ampgt' 1".
this would not be equal as on your database table have("Cat $gt; 1").

try use mysql_escape_string()/ mysql_real_escape_string() as for you input.
htmlspecialchars() for outputing.

[PeteM]

Unfortunately I can't use mysql_escape_string()/ mysql_real_escape_string() as it's a phpBB mod using their DBAL (Database Abstraction Layer).

Anyone else?

Thanks, Pete

[TommyWeb]

I don't think I understand all but try this :

$category = preg_replace('>','$gt;',$HTTP_GET_VARS['category']);

"SELECT * FROM categories WHERE cat_category = '$category'";

Now, $category should be in the same form as the table...

[jatar_k]

I don't quite understand the need to use htmlspecialchars on the input.
Where is it coming from?
why not just store 'Cat > 1'?

it also seems strange to be storing 'Cat > 1'

what does your select look like?

[PeteM]

htmlspecialchars is the recommended technique to prevent SQL injection for phpBB Mods.

Pete

[TommyWeb]

jatar_k > The value of input can easily be edit.. So he use htmlspecialchar on this...

[jatar_k]

I realize what it is used for, yes it can but that is a pretty weak way of stopping injection

doesn't change quotes does it?

I have another question

Why would someone be entering

'Cat > 1'