How to Escape Special Characters in Apache solr in php - php

I want to escape the special character from this solr query
stringfield:/"name":"Elan"/.
I try this one
stringfield:/\".name.\":\".Elan.\"/
but its not working.Is there any other ways to solve this ?

I'm still not getting your setup, but I guess you do a bit too much escaping. And the query in your question looks kind of odd concerning the addressing of fields.
A filter query should only consist of field:value, not field1:field2:value or something...
As a tip, try to assemble the URL manually and get it working. Or use the Solr Admin UI, where you can assemble your query in a form-based manner. You'll also get the query URL from there.
Have you tried to print the URL you assemble in your PHP code and invoke it manually?
Your query URL should look simply like this:
http://localhost:8983/solr/mycore/select?q=*&fq=myfield:"myvalue"
or URL-escaped:
http://localhost:8983/solr/mycore/select?q=*&fq=myfield%3A%22myvalue%22
I guess, your PHP code should look like this:
$solrq .= '&fq=stringfield:"' . urlencode($_POST['name']) . '"';
where $_POST['name'] is hopefully just Elan.

Related

How to handle special characters in fuzzy search query

So my solr query is implemented in two parts,first query does an exact search if there are no results found for exact then it goes to the second query that does a fuzzy search.
every things works fine but in situations like-->A user enters "burg +"
So in exact search no records will come,so second query is called to do a fuzzy search.Now comes the problem my fuzzy query does not understand special characters like +,-* which throws and error.If i dont pass special characters it works fine. But in real world a user can put characters with their search,which will throw an error.
Now iam stuck in this and dont know how to resolve this issue.
This is how my exact search query looks like
$query1="(business_name:$data*^100 OR city_name:$data*^1 OR
locality_name:$data*^6 OR business_search_tag_name:$data*^8 OR
type_name:$data*^7) AND (business_active_flag:1) AND
(business_visible_flag:1) AND (delete_status_businessmasters:0)";
This is how my fuzzy query looks like
$query2='(_query_:%20"{!complexphrase%20qf=business_name^100+type_name^0.4+locality_name^6%27}%20'.$url_new.')AND(business_active_flag:1)AND(business_point:[1.5 TO 2.0])&q.op=AND&wt=json&indent=true';
This is the error iam getting
Cannot parse ' must~1 *~N': '*' or '?' not allowed as first character in WildcardQuery
Iam new to solr and dont know how to tackle this situation.
Details of what iam using
Solrphpclient
php
solr 4.9
ok so i see that you are using solrphpclient.You need to make changes in the service.php file so that these special characters get replaced to either blank or what ever you want.
This will take care of the problem you are facing
$params=str_replace("%", "", $params);
$params=str_replace("*", "", $params);
$params=str_replace("&", "", $params);
you need to put this in the search function or inside you custom function which i assume you are using for the fuzzy query

PHP: Use a $_GET-Param with multiple other Params within a $_GET-Param

yeah, I know, the title is kind of confusing, but no better title came to my mind.
Here is my problem:
I want to use a link in my application, which would look like this:
localhost/index?jumpto=some_folder/somescript.php?someparam1=1234&someparam2=4321
The problem is that &someparam2 is meant to hang on the second $_GET-Param.
It would be like this:
localhost/index?jumpto=some_folder/somescript.php?someparam1=1234&someparam2=4321
Instead, PHP interprets that &someparam2 hangs on the first $_GET-Param.
localhost/index?jumpto=some_folder/somescript.php?someparam1=1234&someparam2=4321
Does anyone know a solution for this?
I already tried
localhost/index?jumpto='some_folder/somescript.php?someparam1=1234&someparam2=4321'
but of course that didn't work.
I hope you can understand my problem.
Thank you for your time.
You will need to URL encode your string some_folder/somescript.php?someparam1=1234 so that php will not parse & in the query string as a param separator.
use urlencode("some_folder/somescript.php?someparam1=1234");

Decode a byte encoded string via my URL

We have a PHP site on Zend Framework with a backend Postgresql database. Our primary character encoding is UTF-8.
I just checked our error log and found a strange entry. My URL is as follows:
www.mydomain.com/schuhe-für-breite-füsse
however someone (or maybe a bot) has tried to access this URL as follows:
www.mydomain.com/schuhe-f\xc3\xbcr-breite-f\xc3\xbcsse/
It's the first time I've seen something like the above. Two things are happening on my page:
1) The above URL is queried against our CMS. This works fine for some reason, I think Postgresql reaslises it is byte-encoded and then converts it back when tried to find this SEF URL in our database.
2) An Ajax request is made on the page, passing the same SEF URL. This fails. I believe the slashes are causing a problem on Javascript.
To avoid this I want to decode any URL that is encoded like this. However a quick test of the following code did not decode anything for me :(
$landing_sef_url = $this->_getParam('landing_sef_url');
$utf8=html_entity_decode($landing_sef_url);
$iso8859=utf8_decode($utf8);
$test3 = html_entity_decode($landing_sef_url, 1, "ISO-8859-1");
$test4 = urldecode($landing_sef_url);
echo utf8_decode("$landing_sef_url");
echo "<br/><br/>";
die($landing_sef_url . " -- $utf8 -- $iso8859 <br/>$test3<br/>$test4");
I found the above via various posts online but they all print back the same result - schuhe-f\xc3\xbcr-breite-f\xc3\xbcsse
Any help would be MUCH appreciated. Many thanks!
This method seems to do what you're looking for:
http://li.php.net/manual/en/function.stripcslashes.php
But if you're just looking to unescape \x## sequences, you could also do this with a fairly simple regular expression.

How do I INSERT the character "&" into a MySQL database?

I think I have seen this question before but I don't think it's answered good enough yet because I can't get it to work.
The case:
I want to insert an URL into my MySQL database like so:
$url = $_POST["url"]; //$_POST["url"] = "http://example.com/?foo=1&bar=2& ...";
$sql = mysql_query("INSERT INTO table(url) values('$url')") or die ("Error: " . mysql_error());
Now, the URL is inserted into the database properly but when I look at it, it looks like this:
http://example.com/?foo=1
It's like the URL is cut right at the "&" character. I have tried: mysql_real_escape_string, htmlspecialchars, escaping by doing "\" etc. Nothing seems to work.
I have read that you might be able to do it with "SQL Plus" or something like that.
Thanks in advance.
Regards, VG
Chances are the problem here is nothing to do with the database query, and more to do with how the url is passed to the page. I suspect you'll find that the URL used to load the page is something like:
http://mydomain.com/?url=http://example.com/?foo=1&bar=2
This will result in a $_GET that looks like this:
array (
'url' => 'http://example.com/?foo=1',
'bar' => '2'
)
What you need is to call page with a URL that looks more like this:
http://mydomain.com/?url=http://example.com/?foo=1%26bar=2
Note that the & has been encoded to %26. Now $_GET will look like this:
array (
'url' => 'http://example.com/?foo=1&bar=2'
)
...and the query will work as expected.
EDIT I've just noticed you're using $_POST, but the same rules apply to the body of the request and I still think this is your problem. If you are, as I suspect, using Javascript/AJAX to call the page, you need to pass the URL string through encodeURIComponent().
It is likely the querystring is not being passed. It looks like you are receiving it from a FORM post. Remember that form posts that use a method of GET append a querystring to pass all of the form variables, so any querystring in the action is typically ignored.
So, the first thing to do is echo the URL before you try to INSERT it to make sure you are getting the data you think you are.
If there are variables you need to pass with the URL, use hidden inputs for that, and a method of GET on the form tag, and they will get magically appended as querystring parameters.
Right !! The problem here is nothing to do with the database query has DaveRandom said.
Just use the javascript function "encodeURIComponent()".
Depending on what you want to do with the stored value, you also urlencode() the string: http://php.net/manual/de/function.urlencode.php
Cheers,
Max
P.S.: SQL*Plus is for Oracle Databases.
maybe escape the url with urlencode then you can decode it if you want to pull it out of the db

SQL injection help

So I was just testing out the mysql_real_escape(); function and what that does is puts a \ before the ". The when the content is echoed back out onto the page I just get content with \'s before any ". So let's say I posted """""""""""""""""""""""""""" all I get is \"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\" echoed back.
Is there some code to remove the \ when it's echoed back onto the page?
By adding those slashes, mysql_real_escape_string just converts the string into the input format for the database. When the data comes out of the database, it should come out without any of the slashes. You shouldn't need to remove them yourself.
Using stripslashes like others are suggesting would do the opposite of mysql_real_escape_string in most cases, but not all of them, and you shouldn't rely on it for that purpose. Mind you, if you find yourself needing to use it for this, you've already done something else wrong.
stripslashes()
http://php.net/manual/en/function.stripslashes.php
You don't need to unescape, ie. remove the slashes - they don't get inserted into the DB. They are only for passing data to MySQL, they are not written to the db. When you SELECT the data, you won't see the slashes.
Do you know how mysql_real_escape() works. Hint: It allows to encode string for SQL usage. For example mysql_query('SELECT * FROM users WHERE name="'.mysql_real_escape_string($name).'"');. It can be used to insert string which won't escape the quotes for example like " or 1=1 -- " making SELECT * FROM users WHERE name="" or 1=1. You have to activate it just before inserting it database.
When you will read this data, slashes won't exist in any way.
Actually, looking at what is below, I will make this answer, not comment...

Categories