#33275 [Com]: strip_tags() strips everything after "<="
ID: 33275
Comment by: nick dot telford at gmail dot com
Reported By: slawek at truxe dot com
Status: Open
Bug Type: Strings related
Operating System: Windows 2003 Server
PHP Version: 4.3.11
New Comment:
Not really much of a bug, strip_tags() simply strips everything between
a pair of angle brackets. It's not designed to be an incredibly
intelligent function.
For your case, where you wish to strip tags out of input to an SQL
query, simply do something like this.
$sql = "SELECT something FROM table WHERE field <= " .
strip_tags($number);
A glance over the Database Security pages in the PHP docs might prove
beneficial: www.php.net/security.database
Previous Comments:
------------------------------------------------------------------------
[2005-06-08 13:55:46] slawek at truxe dot com
Description:
------------
// strip_tags() strips everything after "<="
// strings like >= not affected
<?
$anyvalue = 10 ;
$sql_query = "select * from anytable where anycolumn <= '" . $anyvalue
. "'";
//after that
$sql_query = strip_tags($sql_query);
?>
// result of print $sql_query;
select * from anytable where anycolumn
// should be
select * from anytable where anycolumn <= '10'
Reproduce code:
---------------
// strip_tags() strips everything after "<="
// strings like >= not affected
<?
$anyvalue = 10 ;
$sql_query = "select * from anytable where anycolumn <= '" . $anyvalue
. "'";
//after that
$sql_query = strip_tags($sql_query);
print $sql_query;
?>
Expected result:
----------------
select * from anytable where anycolumn <= '10'
Actual result:
--------------
select * from anytable where anycolumn
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=33275&edit=1
Thread (6 messages)