note 82435 added to function.htmlspecialchars

I was recently exploring some code when I saw this being used to make data safe for "SQL". This function should not be used to make data SQL safe (although to prevent phishing it is perfectly good). Here is an example of how NOT to use this function: <?php $username = htmlspecialchars(trim("$_POST[username]")); $uniqueuser = $realm_db->query("SELECT login FROM accounts WHERE login = '$username'"); ?> (Only other check on $_POST['username'] is to make sure it isn't empty which it is after trim on a white space only name) The problem here is that it is left to default which allows single quote marks which are used in the sql query. Turning on magic quotes might fix it but you should not rely on magic quotes, in fact you should never use it and fix the code instead. There are also problems with \ not being escaped. Even if magic quotes were used there would be the problem of allowing usernames longer than the limit and having some really weird usernames given they are to be used outside of html, this just provide a front end for registering to another system using mysql. Of course using it on the output wouldn;t cause that problem. Another way to make something of a fix would be to use ENT_QUOTE or do: <?php $uniqueuser = $realm_db->query('SELECT login FROM accounts WHERE login = "'.$username.'";'); ?> Eitherway none of these solutions are good practice and are not entirely unflawed. This function should simply never be used in such a fashion. I hope this will prevent newbies using this function incorrectly (as they apparently do). ---- Server IP: 87.124.64.96 Probable Submitter: 87.194.35.228 ---- Manual Page -- http://www.php.net/manual/en/function.htmlspecialchars.php Edit -- https://master.php.net/note/edit/82435 Del: integrated -- https://master.php.net/note/delete/82435/integrated Del: useless -- https://master.php.net/note/delete/82435/useless Del: bad code -- https://master.php.net/note/delete/82435/bad+code Del: spam -- https://master.php.net/note/delete/82435/spam Del: non-english -- https://master.php.net/note/delete/82435/non-english Del: in docs -- https://master.php.net/note/delete/82435/in+docs Del: other reasons-- https://master.php.net/note/delete/82435 Reject -- https://master.php.net/note/reject/82435 Search -- https://master.php.net/manage/user-notes.php