Javascript variable passing text string with apostrophe, get cut off?

Question

I have a block of code that contains this line in a form:

On the receiving end, I have a document that grabs the data like so:

$title = $_POST['title'];

This is being inserted into a database, but any "title" that contains an apostrophe is getting cut off at the apostrophe - see example:

"I Don't Want It" -----> results in "I Don"

"David'd Car" -----> results in "David"

etc.

I did try several php str_replace efforts on the processing side with no luck, such as:

$title = str_replace(''', '"', $_POST['title']);

It appears that the data is not being sent properly, but not sure, Any Suggestions

THIS IS THE FULL BLOCK AND INSERT BELOW THAT:

$.each(playlist, function(index, val) {
        playlistHtml  += ""
        +
        ""
        +
        ""
        + /* TITLE -- ADD TO FAV */
        ""
        "";
        // -----
        // ---- ICONS that preceed track -- YouTube, Vimeo, Audio, Movie etc. -----
        // -----
        if (val.sources[0].media == "0"){ // youtube
            playlistHtml += ""
        }
        if (val.sources[0].media == "1"){ // vimeo
            playlistHtml += ""
        }
        if (val.sources[0].media == "2"){ // soundcloud
            playlistHtml += ""
        }
        if (val.sources[0].media == "3"){ // MP3 audio link
            playlistHtml += ""
        }
        if (val.sources[0].media == "4"){ // MP4 video link
            playlistHtml += ""
        }
        if (val.sources[0].media == "5"){  // radio link
            playlistHtml += ""
        }

        playlistHtml  += " "+val.sources[0].title+"  |  "+val.sources[0].artist+" "

INSERT

$active = $_POST['active'];
$mediatype = $_POST['mediatype'];
$title = $_POST['title'];
// $title = str_replace(''', '"', $_POST['title']);
$artist = $_POST['artist'];
$source_url = $_POST['source_url'];
$playlists = $_POST['playlists'];
$user = $_POST['user'];
$playlist = $_POST['playlist'];

$rec_insert = mysql_query("INSERT INTO member_tracks(active, mediatype, title, artist, source_url, playlists, user) VALUES ('$active', '$mediatype', '$title', '$artist', '$source_url', '$playlists', '$user')");
if(! $rec_insert )
{
    die('Could not enter data: ' . mysql_error());
} else {
    echo '';
    echo '';
    echo 'MusicPax';
    echo '';
    echo '';
    echo '';
    echo 'TRACK ADDED SUCCESSFULLY';
    echo '';
    echo '';
    echo '';
}

// $conn->close();

trincot · Accepted Answer

There are several issues.

First the immediate problem of placing the title in the input element via some jQuery code. You currently build a string that is made up like this:
```
"........"
```
As you already detected, a quote in the title value will break things. You can escape the title by using this function:
```
function escapeHtmlAttribute(s) {
    return s.replace(/&/g, "&").replace(/'/g, "'");
}
```
This encodes the quotes with the appropriate HTML entity, and also escapes the ampersand as otherwise it could be misunderstood as the start of an HTML entity.

So then your string would be built like this:
```
"........"
```
Secondly, you have a similar problem in your PHP code, where you inject the strings directly in your SQL. Not only does it pose a problem with a quote in the title, it opens the door to malicious SQL injection. In the old days you would be advised to circumvent that by calling mysql_real_escape_string:
```
"INSERT INTO ....... VALUES(......, '" + mysql_real_escape_string($title) + "', ....)"
```
... but it is much better to not inject any strings at all and use prepared statements. This brings me to the following point:
You are using the mysql_ set of functions, which were deprecated in PHP 5.0 and are no longer supported since PHP 7. You really must step away from them. Do it today. Instead, the MySQLi or PDO_MySQL extension should be used. Furthermore, you should use prepared statements. That way you no longer need any escaping and do not have any risk of SQL injection. Please read How can I prevent SQL injection in PHP?

Javascript variable passing text string with apostrophe, get cut off?

Answers (2)

Related Questions