Special symbols in PHP errors

Question

When a user inserts special symbols \\ or // in search box, I get following error:

Warning: simplexml_load_file() [function.simplexml-load-file]: I/O warning : failed to load external entity

How to remove it?

    $q=$_GET["abc"];
    $xml = "http://abc/seach?q=".urlencode($q);     
    $Obj = simplexml_load_file($xml);

If you access the URL directly in your browser do you get a well formed XML response? — Treffynnon, Feb 23 '12 at 12:26
The $xml is most likely not being loaded correctly. Check what $xml contains before passing it into simplexml_load_file — lamplightdev, Feb 23 '12 at 12:32
@sandbox yes, simplexml_load_file returns FALSE if it fails. — lamplightdev, Feb 23 '12 at 12:43
@lamplightdev Is there any function in PHP which returns only ALPHABETS, NUMBERS and White SPACE from string? — sandbox, Feb 23 '12 at 13:00
@sandbox this is not the right place for further questions. A quick search brings up http://stackoverflow.com/questions/659025/removing-non-alphanumeric-characters-with-php — lamplightdev, Feb 23 '12 at 14:13

Jeremy Harris · Answer 1 · 2012-02-23T12:47:44.430

0

Why not just remove those symbols (i.e. filter input, which you should be doing anyway) with something like this:

[EDIT]

$q = $_GET["abc"];

// Array of character patterns not allowed
$not_allowed = Array('\\','//');

// Strip from query
$q = str_replace($not_allowed,'',$q);

// Pass to XML
....

edited Feb 23 '12 at 12:47

answered Feb 23 '12 at 12:33

Jeremy Harris

24,318
13
79
133

You do not need the `foreach` loop here. `str_replace` can accept and array of items to replace. See my answer: http://stackoverflow.com/a/9413187/461813 – Treffynnon Feb 23 '12 at 12:42

Treffynnon · Answer 2 · 2012-02-23T12:41:51.287

My best guess, given the information here, is that the script your are accessing is at fault here and not your code. I would suggest that it is not handling the slashes correctly and returning an invalid XML response.

There are three ways around this.

Get them to fix their script so it can handle the slashes
Remove the slashes from the query before it is sent over: $q = str_replace(array('//', '\\'), '', $q);
Attempt to check the headers or XML response for errors

Special symbols in PHP errors

2 Answers2