PHP dataValidation error

Question

In my form am validating user input so i made dataValidation and added htmlspecialchars()

      <?php

header('Content-Type: text/plain');

$post_cat = dataValidation("<a href='test'>Test</a>", ENT_QUOTES, 'UTF-8');

function dataValidation($cleandata) {
    $data = trim($cleandata);
    $data = stripslashes($cleandata);
    $data = htmlspecialchars($cleandata);
    return $cleandata;
}

echo $post_cat;

When i echo i get output like this <a href='test'>Test</a>

But actually when using htmlspecialchars()

Output should be like this :

<a href='test'>Test</a>

But in my case dataValidation function is not working

you aren't using any of your other arguments.

Daniel A. White
– Daniel A. White

2015-01-10 13:31:19 +00:00
Commented Jan 10, 2015 at 13:31 — Daniel A. White
– Daniel A. White, Commented Jan 10, 2015 at 13:31

Halcyon · Accepted Answer · 2015-01-10 13:30:37Z

1

return $cleandata;

Should be

return $data;

Also you're throwing away intermediate values of $data. You probably don't want that.

Not really part of the answer, but I would recommend you use an IDE with code analysis. Code analysis would be able to tell you that $data isn't getting used after each assignment. This would allow you to catch this bug early.

answered Jan 10, 2015 at 13:30

Halcyon

57.7k10 gold badges93 silver badges131 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

user4429106 Over a year ago

am using net beans how do i check in that??

Halcyon Over a year ago

en.wikipedia.org/wiki/Integrated_development_environment basically a really fancy text editor geared for writing code. I personally use PHPStorm which is really great but not free. Eclipse is equally great and free.

Halcyon Over a year ago

I think NetBeans does it automatically. Make sure it detects your language correctly (PHP). Some editors get a little confused when you mix PHP, HTML, CSS and JavaScript in one file.

Halcyon Over a year ago

If you're worried about XSS you don't need stripslashes, htmlspecialchars is sufficient.

Naved Munshi · Accepted Answer · 2015-01-10 13:32:39Z

1

i think it should be like this

   function dataValidation($cleandata) {
     $data = trim($cleandata);
     $data = stripslashes($data);
     $data = htmlspecialchars($data);
     return $data;
   }

answered Jan 10, 2015 at 13:32

Naved Munshi

5071 gold badge5 silver badges17 bronze badges

Collectives™ on Stack Overflow

PHP dataValidation error

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related