Why in the following php code trim,htmlspecialchars and stripslashes not working?

Question

I have a form which contains two fields Username and Password. I want to store the values entered by the user in an array named as stack.

The following code stores the values in the stack array and displays me the array with the exact values which i entered. Even if i have a slash or any html,javascript in my fields it just stores it into the array.

May i know where is my mistake as function check() is not executing properly.

<?php
$hostname = "localhost";
$username = "root";
$password = "";
$db = "test";
$stack = array();
$connect = mysqli_connect($hostname,$username,$password,$db);
if(!$connect){
    die("Couldn't connect to the database");
    exit();
}
function check($data){
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
if(isset($_POST['login'])){
    foreach($_POST as $value){
        if($value == $_POST['login']){
        break;
        }
        else{
            check($value);
            array_push($GLOBALS['stack'],$value);
        }
    }
    print_r($stack);
}

?>

score 1 · Answer 1 · answered Sep 07 '14 at 12:11

1

Please check the commented line.

<?php
$hostname = "localhost";
$username = "root";
$password = "";
$db = "test";
$stack = array();
$connect = mysqli_connect($hostname,$username,$password,$db);
if(!$connect){
    die("Couldn't connect to the database");
    exit();
}
function check($data){
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
if(isset($_POST['login'])){
    foreach($_POST as $value){
        if($value == $_POST['login']){
        break;
        }
        else{
            $value = check($value); //returned value is not captured
            array_push($GLOBALS['stack'],$value);
        }
    }
    print_r($stack);
}

?>

answered Sep 07 '14 at 12:11

Varun Victor

100
5

may i know what to do so that the returned value is captured with the $value – Sagar Sharma Sep 07 '14 at 12:19
i have change the line already. Please compare the line that i have added the comment. – Varun Victor Sep 07 '14 at 12:26
It's not working. It again shows me the values with slash and all – Sagar Sharma Sep 07 '14 at 12:39
try echo $value before pushing into array. – Varun Victor Sep 07 '14 at 12:42
it echoes me the user input whatever i wrote in the fields including all the whitespaces and slashes – Sagar Sharma Sep 07 '14 at 12:50
can you tell me any other method to get rid of the XSS and whitespaces, slashes – Sagar Sharma Sep 07 '14 at 12:51
check this post - http://stackoverflow.com/questions/1336776/xss-filtering-function-in-php – Varun Victor Sep 07 '14 at 12:56

score 1 · Answer 2 · answered Sep 07 '14 at 12:25

1

you got two options.

save the return value from the check function in a variable

$value = check($value);
change function check($data) to function check(&$data)

answered Sep 07 '14 at 12:25

c4pone

777
7
17

Why in the following php code trim,htmlspecialchars and stripslashes not working?

2 Answers2