php - LIKE statement passes wrong character in excel -
my idea search query after click image button redirect query excel code
here code image button
$expquery = select * reginformation name '%da%' , deleted = 0; //this example query <a id="exportbutton" style="margin-left:5px;" href="reglisttoexcel.php?query=<?php echo $expquery ?> " ><img src="images/export_to_excel.png" style="margin-left:0px; width:5%" title='download list'></a> the code reglisttoexcel.php
<?php header('content-type: application/excel'); header('content-disposition: attachment; filename="eventregistrationlogs('.date("y-m-d").').xls"'); ?> <html> <table border=2> <tr> <th>registration id</th><th>name</th><th>gender</th><th>age</th><th>birthdate</th><th>address</th> <th>email address</th><th>employment status</th><th>contact no.</th><th>facebook</th> <th>twitter</th><th>instagram</th><th>event</th> <th>where did hear event?</th><th>photo link</th><th>province</th><th>friend's name</th> <th>friend's email address</th><th>friend's name</th> <th>friend's email address</th><th>date registered</th> </tr> <?php include("dbcon.php"); $query=$_get['query']; echo "$query"; $export = mysql_query($query) or die(mysql_error()); $bgcolor = "f6f7ea"; while($data=mysql_fetch_array($export)) { if ($bgcolor == "ecefd7") { $bgcolor = "f6f7ea"; } else { $bgcolor = "ecefd7"; } if($data['province'] == "") { $province = ""; } else { $query = "select province province provid = $data[province]"; $result = mysql_query($query) or die(mysql_error()); $row = mysql_fetch_array($result); $province = $row['province']; } ?> <tr><td width="1000px" style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['regid']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['name']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['gender']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['age']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['bdate']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['address']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['emailadd']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['employmentstatus']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['contactno']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['facebook']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['twitter']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['instagram']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['event']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['wherehearevent']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['photolink']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $province?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['referfriend1']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['referemail1']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['referfriend2']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['referemail2']?></td> <td style="background-color:#<?echo $bgcolor;?>;>"><?php echo $data['date_register']?></td> </tr> <?php } ?> </table> </body> </html> the query gives excel
select * reginformation name 'Ú%' , deleted = 0
how can fix this?
one of fundamental issues example query not escaped before being passed through subsequent page.
in particular, it's worth using php's "htmlentities" function on $expquery, , validating what's being passed through request. browser tool firebug can this.
additionally, code subject arbitrary sql injection attacks. should using mysqli_escape_string on query (and, ideally, passing through parts dynamic).
Comments
Post a Comment