escaping into php - phpunit

$valid-url = "p1=".rawurlencode($_GET['p1'])."&type=".rawurlencode($_GET['type'])."&os=".rawurlencode($_GET['os'])."&price=".rawurlencode($_GET['price'])."&sort=".rawurlencode($_GET['sort'])."&sort_order=".rawurlencode($_GET['sort_order'])."&perpage=".rawurlencode($perpage)."";
i am trying to build the url and pass it to <a href=''..but its throwing escaping problem...can i get some help on this.

You can't use '-' in variable names! Your fixed code is:
$validurl = "p1=".rawurlencode($_GET['p1'])."&type=".rawurlencode($_GET['type'])."&os=".rawurlencode($_GET['os'])."&price=".rawurlencode($_GET['price'])."&sort=".rawurlencode($_GET['sort'])."&sort_order=".rawurlencode($_GET['sort_order'])."&perpage=".rawurlencode($perpage)."";

You should try to name the variable properly - is not allowed in variable names in PHP
Reference:
http://www.php.net/manual/en/language.variables.basics.php
Quote:
Variables in PHP are represented by a dollar sign followed by the name of the variable. The variable name is case-sensitive.
Variable names follow the same rules as other labels in PHP. A valid variable name starts with a letter or underscore, followed by any number of letters, numbers, or underscores. As a regular expression, it would be expressed thus: '[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*'

Related

Prepared SQLite statement with named parameter that contains spaces

In SQLite you can use named parameters in statements, like this (Python example):
cur.execute("insert into lang values (:foo, :bar)", {'foo': 'a', 'bar': 2})
Is there any way to have parameter names containing spaces? I.e:
cur.execute("insert into lang values (:'foo bar')", {'foo bar': 'a'})
The documentation suggests not but you never know.
Apparently for the #AAA form you can:
The identifier name in this case can include one or more occurrences of "::" and a suffix enclosed in "(...)" containing any text at all.
But that doesn't let you have an arbitrary name since the brackets are still part of the name. So the answer appears to be no.

nginx header variable escape special characters in header name

I want to read a header in nginx.conf which has '-' in it
x-foo-bar
using $http_name
$http_x-foo-bar the value of the variable becomes "-foo-bar"
looks like its trying to find a header named x and then appending -foo-bar to the value
is there any way to escape these "-"s
I tried / but
$http_x/-foo/-bar gives a value of /-foo/-bar
According to the documentation:
a variable name is the field name converted to lower case with dashes
replaced by underscores
Try:
$http_x_foo_bar

When the url contains "e" it no longer matchs the requested route

More than a long talk to explain that bug, here's a screenshot that explains everything :
As soon as we enter an "e" inside the url which correspond to rss_category, it no longer match the route. See :
!
We resolved this by forcing a requirements for {slugCat} to accept anything .^ (they were no requirements before)
If that can help someone somday, and if anyone has a valid explanation, i'll be glad to hear (runing under Symfony 2.1.1).
Wow, difficult one. This happens because when compiling the route, symfony tries to use the character preceeding the variable name as a separator. This code is from RouteCompiler.php:
// Use the character preceding the variable as a separator
$separators = array($match[0][0][0]);
if ($pos !== $len) {
// Use the character following the variable as the separator when available
$separators[] = $pattern[$pos];
}
$regexp = sprintf('[^%s]+', preg_quote(implode('', array_unique($separators)), self::REGEX_DELIMITER));
Symfony does this because usually you will have some kind of separator before the variable name, a route like /upload/rssArticle/{slugCat}, where '/' would be the separator and it is trying to be helpful by letting you use this separator to separate variables in routes which contain several variables. In your case, the character before the variable is an 'e' and that character becomes a separator and that is why your route does not match. If your route had beed /upload/rssArticles{slugCat}, then the 's' would be the separator and that would be the character you would not be able to use.
Maybe you could create an issue on the symfony router component. I think that the preceeding character should not be used as a separator if it is a letter or a number.

ASPX attribute regex parsing in c#

I need to find attribute values in an ASPX file using regular expressions.
That means you don't need to worry about malformed HTML or any HTML related issues.
I need to find the value of a particular attribute (LocText). I want to get what's inside the quotes.
Any ASPX tags such as <%=, <%#, <%$ etc. inside the value don't make sense for this attribute therefore are considered as part of it.
The regex I began with looks like this:
LocText="([^"]+)"
This works great, the first group, which is the result text, gets everything except the double quotes, which are not allowed there (&quot ; must be used instead)
But the ASPX file allows using of single quotes - second regular expression must be applied then.
LocText='([^']+)'
I could use these two regular expressions but I'm looking for a way to connect them.
LocText=("([^"]+)"|'([^']+)')
This also works but doesn't seem very efficient as it's creating unnecessary number of groups. I think this could be somehow done by using backreferences, but I can't get it to work.
LocText=(["']{1})([^\1]+)\1
I thought that by this, I save the single/double quote to the first group and then I tell it to read anything that is NOT the char found in the first group. This is enclosed again by the quote from the first group. Obviously, I'm wrong and it's not working like that.
Is there any way, how to connect the first two expressions together creating just a minimum amount of groups with one group being the value of the attribute I want to get? Is it possible using a backreference for the single/double quote value, or have I completely misunderstood the meaning of them?
I'd say your solution with alternation isn't that bad, but you could use named captures so the result will always be found in the same group's value:
Regex regexObj = new Regex(#"LocText=(?:""(?<attr>[^""]+)""|'(?<attr>[^']+)')");
resultString = regexObj.Match(subjectString).Groups["attr"].Value;
Explanation:
LocText= # Match LocText=
(?: # Either match
"(?<attr>[^"]+)" # "...", capture in named group <attr>
| # or match
'(?<attr>[^']+)' # '...', also capture in named group <attr>
) # End of alternation
Another option would be to use lookahead assertions ([^\1] isn't working because you can't place backreferences inside a character class, but you can use them in lookarounds):
Regex regexObj = new Regex(#"LocText=([""'])((?:(?!\1).)*)\1");
resultString = regexObj.Match(subjectString).Groups[2].Value;
Explanation:
LocText= # Match LocText=
(["']) # Match and capture (group 1) " or '
( # Match and capture (group 2)...
(?: # Try to match...
(?!\1) # (unless it's the quote character we matched before)
. # any character
)* # repeat any number of times
) # End of capturing group 2
\1 # Match the previous quote character

ASP.NET regular expression to restrict consecutive characters

Using ASP.NET syntax for the RegularExpressionValidator control, how do you specify restriction of two consecutive characters, say character 'x'?
You can provide a regex like the following:
(\\w)\\1+
(\\w) will match any word character, and \\1+ will match whatever character was matched with (\\w).
I do not have access to asp.net at the moment, but take this console app as an example:
Console.WriteLine(regex.IsMatch("hello") ? "Not valid" : "Valid"); // Hello contains to consecutive l:s, hence not valid
Console.WriteLine(regex.IsMatch("Bar") ? "Not valid" : "Valid"); // Bar does not contain any consecutive characters, so it's valid
Alexn is right, this is the way you match consecutive characters with a regex, i.e. (a)\1 matches aa.
However, I think this is a case of everything looking like a nail when you're holding a hammer. I would not use regex to validate this input. Rather, I suggest validating this in code (just looping through the string, comparing str[i] and str[i-1], checking for this condition).
This should work:
^((?<char>\w)(?!\k<char>))*$
It matches abc, but not abbc.
The key is to use so called "zero-width negative lookahead assertion" (syntax: (?! subexpression)).
Here we make sure that a group matched with (?<char>\w) is not followed by itself (expressed with (?!\k<char>)).
Note that \w can be replaced with any valid set of characters (\w does not match white-spaces characters).
You can also do it without named group (note that the referenced group has number 2):
^((\w)(?!\2))*$
And its important to start with ^ and end with $ to match the whole text.
If you want to only exclude text with consecutive x characters, you may use this
^((?<char>x)(?!\k<char>)|[^x\W])*$
or without backreferences
^(x(?!x)|[^x\W])*$
All syntax elements for .NET Framework Regular Expressions are explained here.
You can use a regex to validate what's wrong as well as what's right of course. The regex (.)\1 will match any two consecutive characters, so you can just reject any input that gives an IsValid result to that. If this is the only validation you need, I think this way is far easier than trying to come up with a regex to validate correct input instead.

Resources