Tuesday, December 13, 2011

Text encoding transformations

In PHP there are several text encoding transformation that are useful for different purposes.
If you use the GET method, you can make it safer if you pass you Get variable using
  • rawurlencode: Use if you have spaces in the main part of the URL. Replaces non alpha-numeric characters with %ASCII code
  • urlencode: Used in the query part of a URL, or to pass GET variables. Replaces spaces with +
  • htmlspecialcharacters:  Use to prevent user-supplied text from containing HTML markup. Does minimal conversion of HTML characters:  " < > & ' to &XXXX; equivalent
  • htmlentities: Used to prevent user-supplied text from adding any malicious code. Converts all characters with an &...; equivalent.
  • strip_tags: Use to prevent user-supplied text from containing unallowed HTML markup.
  • nl2br: Use to preserve line breaks in user-supplied text.
Example:  Passing on a query
'<a href= "http://www.google.com/?q="'.urlencode("the database student").' ">' ; yields
<a href="https://www.google.com/?q=the+database+student " >
Example: Writing trusted user text to a content page with limited HTML markup and pagebreaks preserved
<?php echo strip_tags(nl2br($sel_page['content']),"<b><br><li><ol><ul><a><i><strong><emp>" ); ?>