Place htmlspecialchars in PHP script

To add in connection.php after mysql_connect:

mysql_set_charset('utf8');

Hello,

It would be preferable to continue the previous discussion, because the context and history are important.

Regarding htmlspecialchars, its role is to clean/secure text before storing it in a database; this function will not resolve accent issues following a hosting provider migration.

So, to better understand, it would be useful to know whether the problem affects the text present in the database, or if it concerns all the text on the page.

Hello,

Look at the examples:

You will need this for everything displayed from content entered by a user (you want to control what is shown and avoid injections)

(Feldrip's answer is also valid)

---

Hello,

The functions htmlspecialchars or htmlentities, as their names indicate, should be used when displaying data in an HTML document.

Contrary to a bad practice unfortunately common, you should not use htmlspecialchars before saving to the database because this will cause other data processing issues in the database.
More info: zestedesavoir.com/articles/2489/ne-pas-confondre-faille-par-injection-sql-et-faille-xss/

If the problem of displaying special characters comes from data stored in the database, the issue often lies with the charset of the database connection.
You simply need to set the charset after the connection, via set_charset with mysqli or in the DNS with PDO (see first comment on the doc):

www.php.net/manual/fr/mysqli.set-charset.php
www.php.net/manual/fr/pdo.construct.php

I just can’t do it! I’ve done it before, but I don’t remember where.

<center><br><br> This site presents a genealogy of the branches <b>HUMBERT, DAMERON ,DAQUIN</b> and <b>MALFOI</b> <br>For confidentiality reasons, only the years of birth < year current - 110.<p> The name <b>DAQUIN</b> was written <b>DACQUIN</b> or <b>D'ACQUIN</b> until the middle of the 18th century.<br> The name <b>MALFOI</b> was written <b>MALFOY</b> until the middle of the 19th century. <BR><BR><BR> This genealogy consists of : <?php include ('connexion/connexion.php'); $date = date("Y"); $date2 = $date-110; $query = 'SELECT count(id) FROM individus WHERE (SUBSTRING(date_naissance, -4) < "'.$date2.'" )'; $result = mysql_query($query) or die (mysql_error()); $resultat=mysql_fetch_row($result); echo "$resultat[0] individus<p>dont<br>"; $query2 = 'SELECT count(id), MIN(RIGHT(date_naissance, 4)) AS date FROM individus WHERE famille LIKE "%HUMBERT%" AND (SUBSTRING(date_naissance, -4) < "'.$date2.'" )'; $result2 = mysql_query($query2) or die (mysql_error()); $resultat2=mysql_fetch_row($result2); $row2 = mysql_fetch_array($result2); echo "$resultat2[0] individus dans la branche xxxxxx <br>"; echo ''.$row2['date'].''; ?> Elle a été préparée et éditée par : <p>XXXXXXX &nbsp;&nbsp; <br> N'hésitez pas à me contacter .....

In fact, it is the é, è and à that are replaced by �

????

Hello,

As mentioned earlier, accent problems can be related to the charset of the database. And when you move a database, it can be related to the original database, the export procedure, the import procedure, and the configuration of the final database. I’ve never touched this on MySQL, but it’s a problem I also encountered with Oracle databases.

And don’t forget the charset of the web pages.

<!DOCTYPE html> <html lang="fr"> <head> <meta charset="utf-8">

I managed to remove the unwanted characters on my homepage by encoding it in utf8 via Notepad++.

Then, via links, I display the content from my database. The problem is still there!

I placed at the beginning of the script

<!DOCTYPE html> <html lang="fr"> <head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <link type="text/css" rel="stylesheet" href="style.css" /> 

no convincing result!

My table in the database is well saved in utf8!

My script:

<!DOCTYPE html> <html lang="fr"> <head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <link type="text/css" rel="stylesheet" href="style.css" /> <?php include ('connexion/connexion.php'); $nom = $_GET['nom']; $date = date("Y"); $date2 = $date-110; $query = 'SELECT id,famille,nom,surnom,prenom,sexe,date_naissance,date_dc FROM individus WHERE famille LIKE "%'.$nom.'%" AND (SUBSTRING(date_naissance, -4) < "'.$date2.'" ) ORDER BY nom, prenom, (SUBSTRING(date_naissance, -4))'; $result = mysql_query($query) or die(mysql_error()); echo '<p></p><center><font size="6"><u>Branche '.$nom.'</u></font><p></p>'; if(isset($_GET['id'])) { $id = $_GET['id']; } else { echo '<div class="essai">'; echo '<table>'; while ($row = mysql_fetch_array($result)) { if (empty($row['date_dc'])) { $row['date_dc'] = " ? "; } if (empty($row['date_naissance'])) { $row['date_naissance'] = " ? "; } if ($row['sexe'] == 'M') { echo '<tr align="left"><td><img src="images/garcon.gif">'; } elseif ($row['sexe'] == 'F') { echo '<tr align="left"><td><img src="images/fille.gif">'; } elseif ($row['sexe'] == '?') { echo '<tr align="left"><td> ? '; } echo '<a href="index.php?page=fiche_indiv&id='.$row['id'].'&famille='.$row['famille'].'&nom='.$row['nom'].'"><i>'.$row['nom'].'</i></a> '.$row['prenom'].''; if ($row['surnom'] != '') { echo '<font size="2"> ('.$row['surnom'].')</font>'; } echo '<font size="1" color="#FFCC66"> ('.$row['date_naissance'].' - '.$row['date_dc'].')</font></td></tr>'; } } echo '</table>'; echo '</div>'; mysql_close(); exit; ?> </center>

Another solution?