Php code symbols escaped after execution (Sublime editor)

Question

I am aware that this might be a question with an obvious answer but I for a php-newbie it is SO not!

I am writing php code with Sublime inside a file together with html and after I execute the files my code changes. The <and > is written with its escaping characters. Help..please..

num_rows ){
        $check= 1;
    } else {
        $check=0;
    }
}

if($check==0){

    $userToEnter =$username;    
    $userToEnter = mysqli_real_escape_string($conn, $userToEnter);

    $passToEnter = $pass;
    $passToEnter = mysqli_real_escape_string($conn, $passToEnter);

    $sql = 'INSERT INTO users (username,password) VALUES ("'.$userToEnter.'","'.$passToEnter.'")';
    // print_r($sql);

    if(mysqli_query($conn, $sql)){

        session_start();


        // print_r('here');
        // print_r($_POST['url']);


        $doc = new DOMDocument();
        // html5 problems with tags
        // libxml_use_internal_errors(true);
        $doc->loadHTMLFile('header_nav.php');
        // html5 problems with tags
        // libxml_clear_errors();

        $doc->getElementById('sign')->setAttribute('display','none');
        $doc->getElementById('logout')->setAttribute('display','block');
        $doc->saveHTMLFile('header_nav.php');

        // header('Location: '.$_POST['url']);

    }

}else{
    print_r('Nope');
}

?>








<?php echo $pageTitile ?>


    
        
        Log in
        Log out

        Yoga Poses
            
                Yoga Levels 
                All levels
                    Level 1
                    Level 2
                    Level 3
                    Level 4
                
                Healthy and Delicious
            

            
                

                ">

                    

                    Register:
                        Username:
                        Password:
                        Repeat pass:
                    
Log in:
                    Username:
                    Password:

inanimatt · Accepted Answer

It looks like this script is modifying itself, and using DOMDocument to do it. PHP scripts aren't valid HTML/XML, so DOMDocument mangles the code up - it's not Sublime's fault :)

The way to make the code do what you expect here is put the header HTML into a separate file (like header_nav.html), manipulate that instead, and then make your script output it to the user rather than save it.

But modifying a file with DOMDocument is probably way over the top for what you need, and there are other problems with that approach too. That file gets given to everyone, so as soon as one person logs in, everyone gets that header_nav. It also writes to disk when you only really need to change the code in memory and pass it to just that user.

Something much more simple would be to have two header html files (like header_logged_in.php and header_logged_out.php) and then make your header_nav.php just include('header_logged_in.php') if the user is logged in, or include('header_logged_out.php') if they're not.

Some other notes:

Never take something from $_POST and put it straight into an SQL query - you trim it, but that’s no safety at all. The safe way to do it is by using prepared statements. Have a look at PHP The Right Way on how to do that (the examples use PDO which is what I’m more familiar with, but mysqli is okay too if you prefer it).
If either $username or $pass are empty, then $check is never set, so you’d get a PHP strict error telling you that $check is undeclared. You could just add $check = 0 before the if ($check == 0)… line to solve that. Also, use true and false instead of 1 and 0, and === instead of == - though it's a matter of taste in this instance, if you do it elsewhere too then it'll bite you eventually.
It’s commented out, but a later line does header(“Location: “.$_POST[‘url’]) which is also kinda bad - anyone could put any URL into that and redirect your users to their site. It’d be better to build the URL yourself or use an array of valid URLs and point to the right key in the array or something.
You start the session, but you don’t put anything in it (like… whether the user is logged in, and what their username is).

Php code symbols escaped after execution (Sublime editor)

Answers (2)

Related Questions