Re: Re: Problems with ;'s

[LostS]

Ohh I just found the problem. Due to the system I am developing on I am being required to use the PHP interface/frame work system. So in the PHP I do this:

<?
$script = "/cgi-bin/hr-bin/index.cgi";

$QSTRING = $QUERY_STRING;

if (isset($HTTP_POST_VARS)) {
    while (list ($header, $value) = each ($HTTP_POST_VARS)) { 
        $QSTRING = $QSTRING.'&'.$header.'='.$value; 
    }
}

virtual($script.'?'.$QSTRING);
?>

Now if my input from a textarea is this (including the quotes) "I am bob; I eat babies" it passes this to the perl script:

\"I am bob

So that is my problem... Can anyone help me??


-----------------------
Billy S.
Slinar Hardtail - Guildless
Datal Ephialtes - Guildless
RallosZek.Net Admin/WebMaster
Aerynth.Net Admin/WebMaster

perl -e '$cat = "cat"; if ($cat =~ /\143\x61\x74/) { print "Its a cat!
+\n"; } else { print "Thats a dog\n"; } print "\n";'

[tye]

use CGI qw( escape );
#[...]
if (isset($HTTP_POST_VARS)) {
    while (list ($header, $value) = each ($HTTP_POST_VARS)) { 
        $QSTRING = $QSTRING.'&'.$header.'='.escape($value);
    }                       # I added this: ^^^^^^^      ^
}

You might also need to escape the $header.

Update: jryan points out that I've used a Perl module to update your PHP code. Perhaps someone can pipe up with the way to URL-encode values in PHP or you can just use the original, still-escaped query string instead of rebuilding it from the now-unescaped parameter values.

        - tye (but my friends call me "Tye")

[broquaint]

In case people wonder what the PHP equivalent of CGI's escape is, it's urlencode. So if we PHP-ify tye's code it might go a little something like this

$QSTRING =  $QUERY_STRING;
$hpv     =& $HTTP_POST_VARS;
if(is_array($hpv) && count($hpv) > 0)
    foreach($hpv as $key => $value)
        $QSTRING .= '&'.$key.'='.urlencode($value);


HTH

broquaint

[LostS]

YOU RULE!!!
That works beautifully... Now I did have to so a s/\"/"/g and s/\'/'/g and a s/\\\\/\\/g but over all it works great now :)

-----------------------
Billy S.
Slinar Hardtail - Guildless
Datal Ephialtes - Guildless
RallosZek.Net Admin/WebMaster
Aerynth.Net Admin/WebMaster



perl -e '$cat = "cat"; if ($cat =~ /\143\x61\x74/) { print "Its a cat!
+\n"; } else { print "Thats a dog\n"; } print "\n";'

[bbfu]

I think your problem lies in the fact that you're not escaping URL-special characters (ie, probably ';', though I don't remember off the top of my head). I don't really know PHP but I have to believe they have a better way of building a query string than how you're doing it. At the very least, I'm sure PHP supplies a function to URL-encode data. Use that.

bbfu
Seasons don't fear The Reaper.
Nor do the wind, the sun, and the rain.
We can be like they are.