PHP prevent html entity creation at string concatenation - php

How can i prevent that PHP converts a recognized part of a string to an html-entity?
So e.g. lets say i have to concat parts together to an url, like:
echo '&' . 'section=' . '<br>';
$a = '&a';
$b = 'mplitude=';
echo "{$a}{$b}" . '<br>';
echo sprintf("%s%s", '&quote', '=');
the code above prints the following:
§ion=
&litude=
"e=
instead of:
&section=
&amplitude=
&quote=
how can this be prevented without throwing filters on it trying to convert the symbols back to an string again?


You need using htmlspecialchars function:
echo htmlspecialchars('&' . 'section=' . '<br>');

Related

php string concatenation "A<"."B" does not work

I'm writing a function to output HTML elements, the problem is: when I try to concatenate this two strings:
$tag = "<" . "tag";
The instruction echo $tag outputs nothing. What is wrong

As mentioned in comments, special characters like <, will be parsed by browser as HTML, therefore you won't see them as you expect.
Its almost the same thing:
$tag = 'p';
echo '<' . $tag '>' . Test . '</' . $tag . '>';
Which is the same as
echo '<p>' . Test . '</p>';
So after script execution you'll see just
Test
in a browser. but when viewing a source, it will be as
<p>Test</p>
If for some reason you want to see HTML tags, then you need to escape special chars using built-in function htmlentities().
In your case, you can just prepare a string, then just echo it like
echo htmlentities($string);

If by tag you mean an HTML entity then its not going to be seen in the browser. You may need to do a 'view source' to see what was created by echo call.

Double string into variable

Basic question, I'm sure this has been answered before. But since I'm not familiar with PHP I don't know what to search for, hence the title of this question.
This code outputs 'my custom field value'
$title = stripslashes($_POST['user-submitted-customfield']);
I'd like to make it 'my custom value from #mysite', something like
$title = stripslashes($_POST['user-submitted-customfield']) + from + #mysite;
which I tried and returned an error

concat string in PHP
USING .
stripslashes($_POST['user-submitted-customfield']).' from #mysite';
from php.net
There are two string operators. The first is the concatenation
operator ('.'), which returns the concatenation of its right and left
arguments. The second is the concatenating assignment operator ('.='),
which appends the argument on the right side to the argument on the
left side. Please read Assignment Operators for more information.

$title = stripslashes($_POST['user-submitted-customfield']).'from'.'#mysite';

If you need a complete string you have to concat the strings with . and you have to set your words in quotes.
$title = stripslashes($_POST['user-submitted-customfield']).' from #mysite';

PHP is different from javascript, we use dots to concatinate strings and strings must be quoted:
$title = stripslashes($_POST['user-submitted-customfield']) . "from #mysite";

There are many ways to achieve that result. Some of them are:
$user_feedback = stripslashes($_POST['user-submitted-customfield']);
$title = $user_feedback . ' from #mysite';
echo $title;
echo '<br>';
$title = "$user_feedback from #mysite";
echo $title;
echo '<br>';
$title = "{$user_feedback} from #mysite";
echo $title;
echo '<br>';
$template = ':user_feedback from #mysite';
$title = str_replace(':user_feedback', $user_feedback, $template);
echo $title;
echo '<br>';
$template = '%s from #mysite';
$title = sprintf($template, $user_feedback);
echo $title;
echo '<br>';

How to encode and decode / character with PHP

In my dynamically generated website sometimes parts of my URLs contain a / character:
Serena Williams/Venus Williams-Andrea Hlavackova/Lucie Hradecka
And, naturally, the URL returns a 404 error as the / sign is considered a folder so the URL doesn't exist.
What would be the PHP function to encode and later decode the string which contains a / character?

You can use PHP: urlencode to encode and its counterpart PHP: urldecode to decode:
urlencode($stringinput)

You can user htmlentities() whit urlencode()
<?php
$query_string = 'foo=' . urlencode($foo) . '&bar=' . urlencode($bar);
echo '<a href="index.php?' . htmlentities($query_string) . '">';
?>

printing a php variable as it is : with all the special characters

Ok I need to find out what is contained inside a PHP variable and I have it to do it visually, is there a function to display whatever that's contained in a string as it is?
For example :
$TEST = '&nbsp' . "\n" . ' ';
if I use echo the output will be :
while i want it to be :
&nbsp\n&nbsp
is it possible? (I hope I was clear enough)
ty

You can use json_encode with htmlspecialchars:
$TEST = ' ' . "\n" . ' ';
echo json_encode(htmlspecialchars($TEST));
Note that json_encode has third agrument in PHP 5.4.

var_dump() should do the work for you?
Example:
echo "<pre>";
var_dump($variable);
echo "</pre>";
Use <pre> to keep the format structure, makes it alot easier to read.
Resources:
http://php.net/manual/en/function.var-dump.php
http://www.w3schools.com/tags/tag_pre.asp

Try print_r, var_dump or var_export functions, you'll find them very handy for this kind of needs!

http://www.php.net/manual/en/function.htmlspecialchars.php
or
http://www.php.net/manual/en/function.htmlentities.php
$TEST = '&nbsp' . "\n" . ' ';
echo htmlspecialchars(str_replace('\n','\\n', $TEST), ENT_QUOTES);
or
$TEST = '&nbsp' . "\n" . ' ';
echo htmlentities(str_replace('\n','\\n',$TEST), ENT_QUOTES);
You may have to encode the newlines manually. If you want to encode them as actual newlines you can use nl2br. Or string replace these characters with your preference. Update: as I have added to the code per request. String replace special characters you wish to see like newlines and tabs.

assuming you want it for the debugging purposes, let me suggest to use urlencode(). I am using it to make sure I don't miss any invisible character.
The output is not that clear but it works for me.

how to define variable from mysql output

I have the following variable which returns my URL as needed. But i need to run str_replace() on it to replace a character before echoing it into my HTML code.
$url = str_replace("%3A", ":", " . nl2br( $row['url']) . ");
As it stands the " . nl2br( $row['url']) . " contains %3A instead of the colon in the URL and for some reason its rendering my links like this
http://www.mydomain.com/http%3A//url.com

I'm not really sure what your question is, but it looks like this is what you want:
$url = urldecode($row['url']);
The %3A is a URL encoded colon (:).

Categories