Encoding problem when using htmlentities method

Question

I've a problem of character encoding in php, so this's the php code:

n_event=$_GET['ndlann'];
$nom_complet=htmlentities(stripslashes($_POST['nom']));
$email_comment=htmlentities(stripslashes($_POST['email']));
$titre_comment=htmlentities(stripslashes($_POST['titre']));
$texte_comment=htmlentities(stripslashes(nl2br($_POST['commentaire'])));
$pays_comment=$_POST['pays'];
$date_ajout=date('Y/m/d');

Data will be added in a database table , you see that this data comes from a comments form, so when the user enters some comments with orient languages carachters (arabic,hebrew...etc), the input data will change to something like :

Ø´Ù�Ø±Ø§ Ø¹Ù�Ù� Ø§Ù�Ù�Ù�Ø¶Ù�Ø

I tried to delete the htmlentities method and that works fine , but does start another problem of comments form security (js scripts will be executed)

What can I do with this situation?

and thanks

how to do it? htmlentities($_POST['comment'],'charset=UTF-8') ?? — SmootQ
– SmootQ, Commented Jan 25, 2011 at 10:39
@Simo TAQUI. Try this: htmlentities($_POST['comment'],ENT_COMPAT,'utf-8') — Marcin
– Marcin, Commented Jan 25, 2011 at 10:43
Okey, thank you ! +1, I'll try this, Just Taqi is without U :), — SmootQ
– SmootQ, Commented Jan 25, 2011 at 10:45

Your Common Sense · Accepted Answer · 2011-01-25 10:52:41Z

2

Do not use htmlentities() ever.

This function has been obsoleted long time ago. Use htmlspecialchars() instead.

you have also bunch of nonsense in your code

doing htmlentities(nl2br(*)) has no sense.
make stripslashes conditional, only if magic quotes are set on.
there is a possible problem with pays field.
I am also afraid that you're taking htmlentities as some sort of SQL escaing function. Am I right?

answered Jan 25, 2011 at 10:52

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

Sign up to request clarification or add additional context in comments.

12 Comments

SmootQ Over a year ago

@Shrapnel , thank you for your answer friend, I will change my code.. but for the pays field , it comes from a select element and I think there's no problem with it :-) +1

Your Common Sense Over a year ago

@Simo you cannot be more wrong. That IS the problem. There is no matter what kind of field in terms of security.

SmootQ Over a year ago

@Shrapnet, I think u're right!, maybe someone can construct a new form but with a textarea with pays name.. and enter a javascript code. thank you for this note. +1

SmootQ Over a year ago

@Sharpnel, and for what purpose must make stripslashes conditional if only magic quotes are set on?? and thank you to clear the matters up. :)

Your Common Sense Over a year ago

@Simo nl2br will add an HTML tag to your text (<br> one). BUT htmlentities WHLL MAKE ENTITIES OUT OF IT! So, it would be not a line break on the HTML page, but literal <br> as is! CAN'T YOU SEE THAT???

|

Alexandre Bourlier · Accepted Answer · 2014-12-16 13:39:44Z

2

In my opinion, and according to the PHP doc, the accepted answer is not correct. Nowhere it is written that this function has been deprecated.

If you set correctly the third argument of the function, called $encoding, it will solve your problem.

I hope this helps.

answered Dec 16, 2014 at 13:39

Alexandre Bourlier

4,1604 gold badges48 silver badges76 bronze badges

Collectives™ on Stack Overflow

Encoding problem when using htmlentities method

2 Answers 2

Do not use htmlentities() ever.

12 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Do not use htmlentities() ever.

12 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related