Data in SQL table is being read as HTML - php

I have a function that fetches one or multiple rows from a database and in php, goes through a series of foreach loops to make a table body from it, like so:
function buildTableRowsByPCS($connection, $numbers) {
$body = NULL;
foreach($numbers as $number) {
$rows = getRowFromPCS($connection, $number);
$body .= '<tr>';
foreach($rows as $row) {
if(is_array($row)) {
$body .= '<td>';
foreach($row as $r) {
$body .= $r.'<br>';
}
$body .= '</td>';
} else {
$body .= '<td>'.$row.'</td>';
}
}
$body .= '</tr>';
}
return $body;
}
It is working fine, but, sometimes one of the columns has a cell of data that seems to be disturbing the html, whether it be a "/" or "<" or ">" etc. Which results in me getting a mismatch error in my datatable. Is there any way whether in php or sql to treat the data gotten as purely text and treat the characters in it as nothing to do with HTML etc?

You can apply htmlspecialchars() or htmlentities() to the value before you output it, that will convert all applicable characters to HTML entities, for instance > will become >.

Related

Putting php arrays into html tags

I am trying to make a table that has different colors for each of its columns. There will be four columns.
$colors = array("background-color:red;", "background-color:gold", "background-color:pink;", "background-color:purple;");
$html = '<table>';
foreach( $array as $key=>$value){
$html .= '<tr style="background-color:white;">';
foreach($value as $key2=>$value2){
$html .= '<td>' . htmlspecialchars($value2) . '</td>';
}
$html .= '</tr>';
}
I created an array called colors that has the strings of the colors I want, but I don't know how to put that into the tag. I tried typing it in there, but since it is a string, it takes it as text instead of as code. Where it says "background-color:white;", I'd like it to call the values from the array instead. Thanks.
You can array_pop for this provided you have exactly 4 columns. You also can't apply background colours to <tr> like that, you need to apply them to the <td>
$colors = array("background-color:red;", "background-color:gold", "background-color:pink;", "background-color:purple;");
$html = '<table>';
foreach( $array as $key=>$value){
$color = array_pop($colors);
$html .= "<tr>";
foreach($value as $key2=>$value2){
$html .= "<td style='{$color}'>" . htmlspecialchars($value2) . '</td>';
}
$html .= '</tr>';
}

how to separate the second comma in a php variable from mysql in html

Sorry if my question is being duplicate because I've tried to find similar questionI've got a data column in MySQL which look something like this :
https://i.stack.imgur.com/3VRI9.png
I've created a form which display the address in html using php.
$pdf_content .= '<div style="padding-left:5%">';
$pdf_content .= $company_name.'<br>';
$pdf_content .= '<div id="errorMessage">'.$address.'<br></div>';
//$pdf_content .= 'Add2,<br>';
//$pdf_content .= 'Add3,<br>';
$pdf_content .= $postcode.'<br>';
$pdf_content .= $state.'<br>';
$pdf_content .= $country.'<br>';
$pdf_content .= $mobile_phone.'<br>';
$pdf_content .= '<b>RE: Quotation for 3<sup>rd</sup> party claim vehicle </b>';
$pdf_content .= '</div><br>';
What I wanted to do now is the address which look something like No.43,Jalan Bandar Bahagia,Taman Pinji Mewah 1 , I wanted to separate the second comma which will look something like this
https://i.stack.imgur.com/0OlG3.png
I've tried but still not working
$pdf_content .= $address.'<br>';
$myList_explode = explode(",",$address);
for($i=0;$i<sizeof($myList_explode);$i++){
echo $myList_explode[$i];
if(($i+1)%2==0){
echo "</br>";
}else{
echo ",";
}
}
Is possible to do it in php while in MySQL it won't be separated?Thanks in advance.
Consume the leading substring before the second occurring comma, then forget it with \K. Then match the second occurring comma and replace it.
Regex prevents having to write a multi-line solution with a loop.
Code: (Demo)
echo preg_replace('~^[^,]*,[^,]*\K,~', '<br>', $address);
Output:
No.43,Jalan Bandar Bahagia<br>Taman Pinji Mewah 1
My pattern bears some similarity to the pattern in this preg_match() call: https://stackoverflow.com/a/65355441/2943403
You can try like this...:
$string = 'No.43,Jalan Bandar Bahagia,Taman Pinji Mewah 1';
echo formatString($string);
// No.43,Jalan Bandar Bahagia
// Taman Pinji Mewah 1
function formatString($inputString) {
$stringToArray = explode(",",$inputString);
$finalString = "";
$count = count($stringToArray) - 1;
foreach($stringToArray as $k => $arr) {
$addon = ",";
if($k == 1) {
$addon = "<br>";
}
if($k == $count) {
$addon = "";
}
$finalString .= $arr.$addon;
}
return $finalString;
}
Basically you create an array from string with explode, loop over it and create a string out of the elements. And since you want to add after second comma, function adds it if $key == 1 (second key).

How to fix “Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)” in PHP output string

I have the following php code
<?php
$Output = '<table><thead><tr>';
$Output .= '<th>Display</th></tr></thead><tbody>';
for ($k = 0; $k < count($ColumnsInSQL); $k++) {
$Output .= '<tr><td>'.$KS_ResultSet_level[$k][strtoupper(trim($ColumnsInSQL[$k]))].'</td></tr>';
}
$Output .= '</tbody></table>';
echo $Output;
?>
Recently I run the code in Veracode and I am getting issue with "echo $Output;".
Can anyone please help me to fix this?
Use htmlentities() to encode special characters in the variable data.
$Output .= '<tr><td>'.htmlentities($KS_ResultSet_level[$k][strtoupper(trim($ColumnsInSQL[$k]))]).'</td></tr>';

PHP converting JSON file into excel table is formatted incorrectly

I have made a PHP file that takes this JSON-based file: http://www.yellowpages.com.iq/ajax/get/register/Categories.php
and converts it into an excel-formatted-table with the formatting of (.cvs) using this code :
$contents = file_get_contents('http://www.yellowpages.com.iq/ajax/get/register/Categories.php');
$data = JSON_decode($contents);
$excel_file = fopen("file.csv", "a+");
$table = "<table border='1'>";
foreach($data as $elem) {
$table .= "<tr>";
foreach($elem as $key => $prop) {
$table .= "<th>$key</th>";
$table .= "<td>$prop</td>";
fwrite($excel_file, "$key,$prop\n");
}
$table .= "</tr>";
}
$table .= "</table>";
echo $table;
But the problem being, is it takes the data and displays it correctly, although it tends to format it like so: id 1
category Advertising
id 2
category Agriculture & FoodÂ
id 3
category Air condition
id 4
category Airlines
id 5
Aluminium & Glass
Instead of what I'm trying to make it look like which I made manually:
Any help would be appreciated!
You could change the code using fputcsv, which takes care of double quotes and escaping them.
For that you need to get the JSON as an associative array (provide the second argument true):
$data = JSON_decode($contents, true);
And then the loop you have would be replaced with this:
// "loop" for the header (only 1 iteration)
foreach($data as $elem) {
$table .= "<tr><th>" . implode("</th><th>", array_keys($elem)) . "</th></tr>";
fputcsv($excel_file, array_keys($elem));
break; // only need one row for header
}
// Restart loop for the data
foreach($data as $elem) {
$table .= "<tr><td>" . implode("</td><td>", $elem) . "</td></tr>";
fputcsv($excel_file, $elem);
}

CSV data export with headers using PHP SQL server

I am trying to export the data from table on SQL server database to the CSV file.
Data is formatted correctly and placed in each separate cells on the file. But the header is not formatted properly and is printed all on to one cell as a continuous stream.
Say you have a,b,c,d as headers :
Header is printed as abcd on to the first cell and is not spitting out on to individual cells. how do we separate them out ?
Here is the code :
$flag = false;
if ($query) {
while( $data = sqlsrv_fetch_array( $query, SQLSRV_FETCH_ASSOC) ) {
foreach($data AS $key => $value){
if(!$flag) {
// display field/column names as first row
$out .= implode("\t", array_keys($data)) . "\n";
//$out .= '"'.$head.'",';
$flag = true;
}
//If the character " exists, then escape it, otherwise the csv file will be invalid.
$pos = strpos($value, '"');
if ($pos !== false) {
$value = str_replace('"', '\"', $value);
}
$out .= '"'.$value.'",';
}
$out .= "\n";
}
$out .= implode("\t", array_keys($data)) . "\n";
Is creating a tab separated line, but elsewhere you are using comma separated.
Probably you want to use comma's here as well:
$out .= implode(",", array_keys($data)) . "\n";

Categories