Member Avatar for kako13

Hi,

A user go to search.php and input the term. If the user want to search for an exact prhase it add to the search term " " just like Google do.

Example:

"apple"

But when the variable is passed to search_results.php it look like this:

//search_results.php
$var = $_GET['search_field'];

echo "User term: " . $var; // display \"apple\"
....

MySQL Query =...

I don't know why PHP add that \ to the string.

  • 4 Contributors
  • 5 Replies
  • 184 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by kako13

Dani AI

Generated

Short answer: those backslashes are escape characters added before the value reached search_results.php. In older PHP installs they typically come from the legacy "magic quotes" behavior (or from code that called an escaping function when building the URL). was right that the quote characters are being escaped; is correct that browsers URL-encode but do not add backslashes; and 's stripslashes-based quick fix explains why removing the added slashes made the output look normal. See the PHP docs on get_magic_quotes_gpc() for background. (https://www.php.net/manual/en/function.get-magic-quotes-gpc.php)

A more robust, future-proof approach:

  • Read the raw GET value (use filter_input()), undo magic-quotes only if the environment reports it, and then pass the raw search string (including the user-entered double quotes) as a bound parameter to the database. MySQL boolean full-text treats a double-quoted phrase as a phrase search, so the quotes must be preserved for exact-phrase queries. Use a prepared statement (PDO or MySQLi) to supply the term so you do not build SQL by concatenation.

Example (outline):

<?php
$term = filter_input(INPUT_GET, 'search_field', FILTER_UNSAFE_RAW);
if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
    $term = stripslashes($term);
}
$pdo = new PDO(...); // set ERRMODE = EXCEPTION
$stmt = $pdo->prepare("SELECT * FROM articles WHERE MATCH(title,body) AGAINST(:q IN BOOLEAN MODE)");
$stmt->execute([':q' => $term]);
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
?>

Notes and cautions: magic quotes were deprecated/removed long ago (do not rely on them); if you must support very old servers, check for and strip those slashes at input time. Always use parameterized queries (see OWASP SQL Injection guidance) and escape only for the output context (use htmlspecialchars() when echoing into HTML). See the PHP filter_input() docs, the MySQL boolean full-text docs for phrase behavior, and OWASP on prepared statements. (https://www.php.net/manual/en/function.filter-input.php) (https://dev.mysql.com/doc/refman/8.0/en/fulltext-boolean.html) (https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html) (https://www.php.net/manual/en/function.stripslashes.php) (https://www.php.net/manual/en/migration70.incompatible.php)

Recommended Answers

All 5 Replies

Member Avatar for TommyBs

its because it is escaping the " character. Think about it if it echoed it straight out it would end up messing up the code.

Look up htmlentities and and encode it with ENT_QUOTES

$var = htmlentities($_GET, ENT_QUOTES);

Unless you really, REALLY trust your users, you need to validate $_GET; especially if you use that in your MySQL query

Member Avatar for samarudge

This is nothing to do with PHP, its all to do with the browsers trying to "URL Encode" the strings.

Member Avatar for kako13

its because it is escaping the " character. Think about it if it echoed it straight out it would end up messing up the code.

Look up htmlentities and and encode it with ENT_QUOTES

$var = htmlentities($_GET, ENT_QUOTES);

Unless you really, REALLY trust your users, you need to validate $_GET; especially if you use that in your MySQL query

Well the issue is that I need the user to be able to use " " in order to search for an exact phrase under MySQL Full Text Search In Boolean Mode. So how I can do it? Moreover, Can you give me a hint with the validation? Az-0-9 +,-," "

Member Avatar for cwarn23

There are two possibilities to solve this problem. One is that if you are getting php to write a link with non alpha/numeric characters then simply use the urlencode() function. If however you are using a form with method=get and posts those characters into the url automatically then simply use the stripslashes() function on your $_GET tag. Below is an example of both cases:

<?
//example one
$id=urlencode('$@^*$@#%asdf23049582034985');
echo '<a href="index.php?id='.$id.'">test</a>';

//example two
$_GET['variable']=stripslashes($_GET['variable']);
echo $_GET['variable'];
?>

That will give you something to try and google about.

Member Avatar for kako13

There are two possibilities to solve this problem. One is that if you are getting php to write a link with non alpha/numeric characters then simply use the urlencode() function. If however you are using a form with method=get and posts those characters into the url automatically then simply use the stripslashes() function on your $_GET tag. Below is an example of both cases:

<?
//example one
$id=urlencode('$@^*$@#%asdf23049582034985');
echo '<a href="index.php?id='.$id.'">test</a>';

//example two
$_GET['variable']=stripslashes($_GET['variable']);
echo $_GET['variable'];
?>

That will give you something to try and google about.

Thanks. The second method work.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.