trim() expects parameter 1 to be string, array given in - php

I have this PHP function for converts all the html special characters to html entities, UTF-8 compatible.
function safe($input) {
$text = trim($input); //<-- LINE 31
$text = preg_replace("/(\r\n|\n|\r)/", "\n", $text); // cross-platform newlines
$text = preg_replace("/\n\n\n\n+/", "\n", $text); // take care of duplicates
$text = htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
$text = stripslashes($text);
$text = str_replace ( "\n", " ", $text );
$text = str_replace ( "\t", " ", $text );
return $text;
}
Now, I check my script using acunetix web vuln scanner and i see this error :
This page contains an error/warning message that may disclose sensitive information.The message can also contain the location of the file that produced the unhandled exception.
This may be a false positive if the error message is found in documentation pages.
This vulnerability affects /cms/submit.php.
Discovered by: Scripting (Error_Message.script).
Attack details
URL encoded POST input access was set to 2
Error message found:
<b>Warning</b>: trim() expects parameter 1 to be string, array given in <b>C:\xampp\htdocs\cms\includes\safefunc.php</b> on line <b>31</b><br />
How do i fix this?

As others have said, the error is self explanatory and this function is not built to handle arrays. If you need to handle arrays then something like this:
function safe($input) {
if(is_array($input)) {
return array_map('safe', $input);
}
// rest of code
}

Read the Warning, and your answer is there.
Trim must receive a string as parameter, not a array.
Use
var_dump($input) to check your input variable type.
Could you show the code that call function safe()?

try to stringify the $input by using
json_encode($input)
it worked for me

Related

PHP Convert Unicode to text

I am receiving from a form the following urlencoded string %F0%9D%90%B4%F0%9D%91%99%F0%9D%91%92%F0%9D%91%97%F0%9D%91%8E%F0%9D%91%9B%F0%9D%91%91%F0%9D%91%9F%F0%9D%91%8E
If I decode it I get the following formatted text: ๐ด๐‘™๐‘’๐‘—๐‘Ž๐‘›๐‘‘๐‘Ÿ๐‘Ž
Is there any way with PHP to get the plain "Alejandra" text from the encoded or decoded string?
I have tried without success several ways to do it with
mb_convert_encoding($string, "UTF-16",mb_detect_encoding($string))
iconv('utf-16', 'utf-8', rawurldecode($string)
and any other solution I could in stackoverflow.
Edit:
I tried the proposed solution $strAscii = iconv('UTF-8','ASCII//TRANSLIT',$str); but it deletes the special characters such as รกรฉรญรณรบรฑรง which we need to stay.
Expected result
input: ๐ด๐‘™๐‘’๐‘—๐‘Ž๐‘›๐‘‘๐‘Ÿ๐‘Ž
output: Alejandra
input: รlejandra
output: รlejandra
Thank you in advance.
urldecode or rawurldecode is sufficient.
$string = "%F0%9D%90%B4%F0%9D%91%99%F0%9D%91%92%F0%9D%91%97%F0%9D%91%8E%F0%9D%91%9B%F0%9D%91%91%F0%9D%91%9F%F0%9D%91%8E";
$str = urldecode($string);
var_dump($str);
//string(36) "๐ด๐‘™๐‘’๐‘—๐‘Ž๐‘›๐‘‘๐‘Ÿ๐‘Ž"
Demo: https://3v4l.org/OMQ35
A special debugger gives me: string(36) UTF-8mb4. This means that there are also UTF-8 characters in the string that require 4 bytes. The character A is the Unicode character โ€œ๐ดโ€ (U+1D434).
Note:
If the special UTF-8 characters cause problems, you can try to display the strings as ASCII characters with iconv.
$strAscii = iconv('UTF-8','ASCII//TRANSLIT',$str);
//string(9) "Alejandra"
What you are getting is called a "psuedo-alphabet", you can see a list of them here: https://qaz.wtf/u/convert.cgi. The one that you appear to be getting can be seen here: https://en.wikipedia.org/wiki/Mathematical_Alphanumeric_Symbols
Basically what you need to do is take the string, split it and use a lookup table to convert it back to regular characters. This implementation is terribly efficient but that's because I grabbed the alphabets from the above Wikipedia page and was too lazy to reorganise it.
function math_symbols_to_plain_text($input, $alphabet)
{
$alphabets = [
['a','๐š','๐‘Ž','๐’‚','๐–บ','๐—ฎ','๐˜ข','๐™–','๐’ถ','๐“ช','๐”ž','๐–†','๐šŠ','๐•’'],
['b','๐›','๐‘','๐’ƒ','๐–ป','๐—ฏ','๐˜ฃ','๐™—','๐’ท','๐“ซ','๐”Ÿ','๐–‡','๐š‹','๐•“'],
['c','๐œ','๐‘','๐’„','๐–ผ','๐—ฐ','๐˜ค','๐™˜','๐’ธ','๐“ฌ','๐” ','๐–ˆ','๐šŒ','๐•”'],
['d','๐','๐‘‘','๐’…','๐–ฝ','๐—ฑ','๐˜ฅ','๐™™','๐’น','๐“ญ','๐”ก','๐–‰','๐š','๐••'],
['e','๐ž','๐‘’','๐’†','๐–พ','๐—ฒ','๐˜ฆ','๐™š','โ„ฏ','๐“ฎ','๐”ข','๐–Š','๐šŽ','๐•–'],
['f','๐Ÿ','๐‘“','๐’‡','๐–ฟ','๐—ณ','๐˜ง','๐™›','๐’ป','๐“ฏ','๐”ฃ','๐–‹','๐š','๐•—'],
['g','๐ ','๐‘”','๐’ˆ','๐—€','๐—ด','๐˜จ','๐™œ','โ„Š','๐“ฐ','๐”ค','๐–Œ','๐š','๐•˜'],
['h','๐ก','โ„Ž','๐’‰','๐—','๐—ต','๐˜ฉ','๐™','๐’ฝ','๐“ฑ','๐”ฅ','๐–','๐š‘','๐•™'],
['i','๐ข','๐‘–','๐’Š','๐—‚','๐—ถ','๐˜ช','๐™ž','๐’พ','๐“ฒ','๐”ฆ','๐–Ž','๐š’','๐•š'],
['j','๐ฃ','๐‘—','๐’‹','๐—ƒ','๐—ท','๐˜ซ','๐™Ÿ','๐’ฟ','๐“ณ','๐”ง','๐–','๐š“','๐•›'],
['k','๐ค','๐‘˜','๐’Œ','๐—„','๐—ธ','๐˜ฌ','๐™ ','๐“€','๐“ด','๐”จ','๐–','๐š”','๐•œ'],
['l','๐ฅ','๐‘™','๐’','๐—…','๐—น','๐˜ญ','๐™ก','๐“','๐“ต','๐”ฉ','๐–‘','๐š•','๐•'],
['m','๐ฆ','๐‘š','๐’Ž','๐—†','๐—บ','๐˜ฎ','๐™ข','๐“‚','๐“ถ','๐”ช','๐–’','๐š–','๐•ž'],
['n','๐ง','๐‘›','๐’','๐—‡','๐—ป','๐˜ฏ','๐™ฃ','๐“ƒ','๐“ท','๐”ซ','๐–“','๐š—','๐•Ÿ'],
['o','๐จ','๐‘œ','๐’','๐—ˆ','๐—ผ','๐˜ฐ','๐™ค','โ„ด','๐“ธ','๐”ฌ','๐–”','๐š˜','๐• '],
['p','๐ฉ','๐‘','๐’‘','๐—‰','๐—ฝ','๐˜ฑ','๐™ฅ','๐“…','๐“น','๐”ญ','๐–•','๐š™','๐•ก'],
['q','๐ช','๐‘ž','๐’’','๐—Š','๐—พ','๐˜ฒ','๐™ฆ','๐“†','๐“บ','๐”ฎ','๐––','๐šš','๐•ข'],
['r','๐ซ','๐‘Ÿ','๐’“','๐—‹','๐—ฟ','๐˜ณ','๐™ง','๐“‡','๐“ป','๐”ฏ','๐–—','๐š›','๐•ฃ'],
['s','๐ฌ','๐‘ ','๐’”','๐—Œ','๐˜€','๐˜ด','๐™จ','๐“ˆ','๐“ผ','๐”ฐ','๐–˜','๐šœ','๐•ค'],
['t','๐ญ','๐‘ก','๐’•','๐—','๐˜','๐˜ต','๐™ฉ','๐“‰','๐“ฝ','๐”ฑ','๐–™','๐š','๐•ฅ'],
['u','๐ฎ','๐‘ข','๐’–','๐—Ž','๐˜‚','๐˜ถ','๐™ช','๐“Š','๐“พ','๐”ฒ','๐–š','๐šž','๐•ฆ'],
['v','๐ฏ','๐‘ฃ','๐’—','๐—','๐˜ƒ','๐˜ท','๐™ซ','๐“‹','๐“ฟ','๐”ณ','๐–›','๐šŸ','๐•ง'],
['w','๐ฐ','๐‘ค','๐’˜','๐—','๐˜„','๐˜ธ','๐™ฌ','๐“Œ','๐”€','๐”ด','๐–œ','๐š ','๐•จ'],
['x','๐ฑ','๐‘ฅ','๐’™','๐—‘','๐˜…','๐˜น','๐™ญ','๐“','๐”','๐”ต','๐–','๐šก','๐•ฉ'],
['y','๐ฒ','๐‘ฆ','๐’š','๐—’','๐˜†','๐˜บ','๐™ฎ','๐“Ž','๐”‚','๐”ถ','๐–ž','๐šข','๐•ช'],
['z','๐ณ','๐‘ง','๐’›','๐—“','๐˜‡','๐˜ป','๐™ฏ','๐“','๐”ƒ','๐”ท','๐–Ÿ','๐šฃ','๐•ซ'],
['A','๐€','๐ด','๐‘จ','๐– ','๐—”','๐˜ˆ','๐˜ผ','๐’œ','๐“','๐”„','๐•ฌ','๐™ฐ','๐”ธ'],
['B','๐','๐ต','๐‘ฉ','๐–ก','๐—•','๐˜‰','๐˜ฝ','โ„ฌ','๐“‘','๐”…','๐•ญ','๐™ฑ','๐”น'],
['C','๐‚','๐ถ','๐‘ช','๐–ข','๐—–','๐˜Š','๐˜พ','๐’ž','๐“’','โ„ญ','๐•ฎ','๐™ฒ','โ„‚'],
['D','๐ƒ','๐ท','๐‘ซ','๐–ฃ','๐——','๐˜‹','๐˜ฟ','๐’Ÿ','๐““','๐”‡','๐•ฏ','๐™ณ','๐”ป'],
['E','๐„','๐ธ','๐‘ฌ','๐–ค','๐—˜','๐˜Œ','๐™€','โ„ฐ','๐“”','๐”ˆ','๐•ฐ','๐™ด','๐”ผ'],
['F','๐…','๐น','๐‘ญ','๐–ฅ','๐—™','๐˜','๐™','โ„ฑ','๐“•','๐”‰','๐•ฑ','๐™ต','๐”ฝ'],
['G','๐†','๐บ','๐‘ฎ','๐–ฆ','๐—š','๐˜Ž','๐™‚','๐’ข','๐“–','๐”Š','๐•ฒ','๐™ถ','๐”พ'],
['H','๐‡','๐ป','๐‘ฏ','๐–ง','๐—›','๐˜','๐™ƒ','โ„‹','๐“—','โ„Œ','๐•ณ','๐™ท','โ„'],
['I','๐ˆ','๐ผ','๐‘ฐ','๐–จ','๐—œ','๐˜','๐™„','โ„','๐“˜','โ„‘','๐•ด','๐™ธ','๐•€'],
['J','๐‰','๐ฝ','๐‘ฑ','๐–ฉ','๐—','๐˜‘','๐™…','๐’ฅ','๐“™','๐”','๐•ต','๐™น','๐•'],
['K','๐Š','๐พ','๐‘ฒ','๐–ช','๐—ž','๐˜’','๐™†','๐’ฆ','๐“š','๐”Ž','๐•ถ','๐™บ','๐•‚'],
['L','๐‹','๐ฟ','๐‘ณ','๐–ซ','๐—Ÿ','๐˜“','๐™‡','โ„’','๐“›','๐”','๐•ท','๐™ป','๐•ƒ'],
['M','๐Œ','๐‘€','๐‘ด','๐–ฌ','๐— ','๐˜”','๐™ˆ','โ„ณ','๐“œ','๐”','๐•ธ','๐™ผ','๐•„'],
['N','๐','๐‘','๐‘ต','๐–ญ','๐—ก','๐˜•','๐™‰','๐’ฉ','๐“','๐”‘','๐•น','๐™ฝ','โ„•'],
['O','๐Ž','๐‘‚','๐‘ถ','๐–ฎ','๐—ข','๐˜–','๐™Š','๐’ช','๐“ž','๐”’','๐•บ','๐™พ','๐•†'],
['P','๐','๐‘ƒ','๐‘ท','๐–ฏ','๐—ฃ','๐˜—','๐™‹','๐’ซ','๐“Ÿ','๐”“','๐•ป','๐™ฟ','โ„™'],
['Q','๐','๐‘„','๐‘ธ','๐–ฐ','๐—ค','๐˜˜','๐™Œ','๐’ฌ','๐“ ','๐””','๐•ผ','๐š€','โ„š'],
['R','๐‘','๐‘…','๐‘น','๐–ฑ','๐—ฅ','๐˜™','๐™','โ„›','๐“ก','โ„œ','๐•ฝ','๐š','โ„'],
['S','๐’','๐‘†','๐‘บ','๐–ฒ','๐—ฆ','๐˜š','๐™Ž','๐’ฎ','๐“ข','๐”–','๐•พ','๐š‚','๐•Š'],
['T','๐“','๐‘‡','๐‘ป','๐–ณ','๐—ง','๐˜›','๐™','๐’ฏ','๐“ฃ','๐”—','๐•ฟ','๐šƒ','๐•‹'],
['U','๐”','๐‘ˆ','๐‘ผ','๐–ด','๐—จ','๐˜œ','๐™','๐’ฐ','๐“ค','๐”˜','๐–€','๐š„','๐•Œ'],
['V','๐•','๐‘‰','๐‘ฝ','๐–ต','๐—ฉ','๐˜','๐™‘','๐’ฑ','๐“ฅ','๐”™','๐–','๐š…','๐•'],
['W','๐–','๐‘Š','๐‘พ','๐–ถ','๐—ช','๐˜ž','๐™’','๐’ฒ','๐“ฆ','๐”š','๐–‚','๐š†','๐•Ž'],
['X','๐—','๐‘‹','๐‘ฟ','๐–ท','๐—ซ','๐˜Ÿ','๐™“','๐’ณ','๐“ง','๐”›','๐–ƒ','๐š‡','๐•'],
['Y','๐˜','๐‘Œ','๐’€','๐–ธ','๐—ฌ','๐˜ ','๐™”','๐’ด','๐“จ','๐”œ','๐–„','๐šˆ','๐•'],
['Z','๐™','๐‘','๐’','๐–น','๐—ญ','๐˜ก','๐™•','๐’ต','๐“ฉ','โ„จ','๐–…','๐š‰','โ„ค']
];
$replace = ['a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z'];
$lookup = [
'serif-normal',
'serif-bold',
'serif-italic',
'serif-bolditalic',
'sans-normal',
'sans-bold',
'sans-italic',
'sans-bolditalic',
'script-normal',
'script-bold',
'franktur-normal',
'fraktur-bold',
'monospace',
'doublestruck'
];
$map_index = array_search($alphabet, $lookup);
$split = mb_str_split($input);
$output = '';
foreach ($split as $char) {
foreach ($alphabets as $i => $letter) {
if ($letter[$map_index] === $char)
$output .= $replace[$i];
}
}
return $output;
}
$input = '๐ด๐‘™๐‘’๐‘—๐‘Ž๐‘›๐‘‘๐‘Ÿ๐‘Ž';
$output = math_symbols_to_plain_text($input, 'serif-italic');
echo $input . PHP_EOL . $output . PHP_EOL;
Yields:
๐ด๐‘™๐‘’๐‘—๐‘Ž๐‘›๐‘‘๐‘Ÿ๐‘Ž
Alejandra
If I am not wrong, you are trying to decode URL then why you are not trying to use urldecode()
follow this .PHP DOC

PHP str_replace removing unintentionally removing Chinese characters

i have a PHP scripts that removes special characters, but unfortunately, some Chinese characters are also removed.
<?php
function removeSpecialCharactersFromString($inputString){
$inputString = str_replace(str_split('#/\\:*?\"<>|[]\'_+(),{}โ€™! &'), "", $inputString);
return $inputString;
}
$test = '่ตตๆ™ฏ็„ถ ่ตตๆ™ฏ็„ถ';
print(removeSpecialCharactersFromString($test));
?>
oddly, the output is ่ตต็„ถ ่ตต็„ถ. The character ๆ™ฏ is removed
in addition, ้™ˆ ไธ€ is also removed. What might be the possible cause?
The string your using to act as a list of the things you want to replace doesn't work well with the mixed encoding. What I've done is to convert this string to UTF16 and then split it.
function removeSpecialCharactersFromString($inputString){
$inputString = str_replace(str_split(
mb_convert_encoding('#/\\:*?\"<>|[]\'_+(),{}โ€™! &', 'UTF16')), "", $inputString);
return $inputString;
}
$test = '#่ตตๆ™ฏ็„ถ ่ตตๆ™ฏ็„ถ';
print(removeSpecialCharactersFromString($test));
Which gives...
่ตตๆ™ฏ็„ถ่ตตๆ™ฏ็„ถ
BTW -str_replace is MB safe - sort of recognised the poster... http://php.net/manual/en/ref.mbstring.php#109937

PHP: replacing bad characters

It's more than possible this already has an answer, however since encoding is far from my strong point I don't really know what to search for to find out.
Essentially, I have a string that contains (what I would call) 'bad' characters. For context, this string is coming back from a cURL response. Example:
$bad_str = "Sundayรขโ‚ฌโ„ขs";
Question: How to swap these out for more readable substitutes?
This would be a lot easier if I knew what this sort of problem was called, or what sort of encoding it corresponded to. I have read:
Strip Bad Characters from an HTML PHP Contact Form
PHP encoding: Delete some bad characters
I have tried creating a swaps map and running preg_replace_callback on it, i.e.:
$encoding_swapouts_map = array(
'รขโ‚ฌโ„ข' => "'",
'รƒยฉ' => 'รฉ',
'รขโ‚ฌโ€œ' => '-',
'ร‚ยฃ' => 'ยฃ'
);
$bad_str = preg_replace_callback(
$ptn = '/'.implode('|', array_keys($encoding_swapouts_map)).'/i',
function($match) use ($encoding_swapouts_map) {
return $encoding_swapouts_map[$match[0]];
},
$str
);
This doesn't seem to match the bad characters, so the callback is never called. Interestingly, $ptn, when printed out, shows some mutation:
/รƒยขรขโ€šยฌรขโ€žยข|รƒฦ’ร‚ยฉ|รƒยขรขโ€šยฌรขโ‚ฌล“|รƒโ€šร‚ยฃ/i
Thanks in advance.
What happened to the answer that I liked? (it was deleted).
I think it had a typo, however.
$text = "Sundayรขโ‚ฌโ„ขs";
$bad = array("รขโ‚ฌโ„ข","รƒยฉ","รขโ‚ฌโ€œ","ร‚ยฃ");
$good = array("'","รฉ","-","ยฃ");
$newtext = str_replace($bad, $good, $text);

PHP Preg_Replace REGEX BB-Code

So I have created this function in PHP to output text in the required form. It is a simple BB-Code system. I have cut out the other BB-Codes from it to keep it shorter (Around 15 cut out)
My issue is the final one [title=blue]Test[/title] (Test data) does not work. It outputs exactly the same. I have tried 4-5 different versions of the REGEX code and nothing has changed it.
Does anyone know where I am going wrong or how to fix it?
function bbcode_format($str){
$str = htmlentities($str);
$format_search = array(
'#\[b\](.*?)\[/b\]#is',
'#\[title=(.*?)\](.*?)\[/title\]#i'
);
$format_replace = array(
'<strong>$1</strong>',
'<div class="box_header" id="$1"><center>$2</center></div>'
);
$str = preg_replace($format_search, $format_replace, $str);
$str = nl2br($str);
return $str;
}
Change the delimiter # to /. And change "/[/b\]" to "\[\/b\]". You need to escape the "/" since you need it as literal character.
Maybe the "array()" should use brackets: "array[]".
Note: I borrowed the answer from here: Convert BBcode to HTML using JavaScript/jQuery
Edit: I forgot that "/" isn't a metacharacter so I edited the answer accordingly.
Update: I wasn't able to make it work with function, but this one works. See the comments. (I used the fiddle on the accepted answer for testing from the question I linked above. You may do so also.) Please note that this is JavaScript. You had PHP code in your question. (I can't help you with PHP code at least for awhile.)
$str = 'this is a [b]bolded[/b], [title=xyz xyz]Title of something[/title]';
//doesn't work (PHP function)
//$str = htmlentities($str);
//notes: lose the single quotes
//lose the text "array" and use brackets
//don't know what "ig" means but doesn't work without them
$format_search = [
/\[b\](.*?)\[\/b\]/ig,
/\[title=(.*?)\](.*?)\[\/title\]/ig
];
$format_replace = [
'<strong>$1</strong>',
'<div class="box_header" id="$1"><center>$2</center></div>'
];
// Perform the actual conversion
for (var i =0;i<$format_search.length;i++) {
$str = $str.replace($format_search[i], $format_replace[i]);
}
//place the formatted string somewhere
document.getElementById('output_area').innerHTML=$str;
โ€‹
Update2: Now with PHP... (Sorry, you have to format the $replacements to your liking. I just added some tags and text to demostrate the changes.) If there's still trouble with the "title", see what kind of text you are trying to format. I made the title "=" optional with ? so it should work properly work texts like: "[title=id with one or more words]Title with id[/title]" and "[title]Title without id[/title]. Not sure thought if the id attribute is allowed to have spaces, I guess not: http://reference.sitepoint.com/html/core-attributes/id.
$str = '[title=title id]Title text[/title] No style, [b]Bold[/b], [i]emphasis[/i], no style.';
//try without this if there's trouble
$str = htmlentities($str);
//"#" works as delimiter in PHP (not sure abut JS) so no need to escape the "/" with a "\"
$patterns = array();
$patterns = array(
'#\[b\](.*?)\[/b\]#',
'#\[i\](.*?)\[/i\]#', //delete this row if you don't neet emphasis style
'#\[title=?(.*?)\](.*?)\[/title\]#'
);
$replacements = array();
$replacements = array(
'<strong>$1</strong>',
'<em>$1</em>', // delete this row if you don't need emphasis style
'<h1 id="$1">$2</h1>'
);
//perform the conversion
$str = preg_replace($patterns, $replacements, $str);
echo $str;

converting & to & for XML in PHP

I am building a XML RSS for my page. And running into this error:
error on line 39 at column 46: xmlParseEntityRef: no name
Apparently this is because I cant have & in XML... Which I do in my last field row...
What is the best way to clean all my $row['field']'s in PHP so that &'s turn into &
Use htmlspecialchars to encode just the HTML special characters &, <, >, " and optionally ' (see second parameter $quote_style).
It's called htmlentities() and html_entity_decode()
Really should look in the dom xml functions in php. Its a bit of work to figure out, but you avoid problems like this.
Convert Reserved XML characters to Entities
function xml_convert($str, $protect_all = FALSE)
{
$temp = '__TEMP_AMPERSANDS__';
// Replace entities to temporary markers so that
// ampersands won't get messed up
$str = preg_replace("/&#(\d+);/", "$temp\\1;", $str);
if ($protect_all === TRUE)
{
$str = preg_replace("/&(\w+);/", "$temp\\1;", $str);
}
$str = str_replace(array("&","<",">","\"", "'", "-"),
array("&", "<", ">", """, "&apos;", "-"),
$str);
// Decode the temp markers back to entities
$str = preg_replace("/$temp(\d+);/","&#\\1;",$str);
if ($protect_all === TRUE)
{
$str = preg_replace("/$temp(\w+);/","&\\1;", $str);
}
return $str;
}
Use
html_entity_decode($row['field']);
This will take and revert back to the & from & also if you have &npsb; it will change that to a space.
http://us.php.net/html_entity_decode
Cheers

Categories