I've created a text area in vBulletin Options for the re-release of the AME (Auto Media Embedding) modification. In this field, admins will be able to add lines of code to their
SHOWTHREAD template's <body> or <head> tags. I did this for support of media embedding that requires only one instantiation per page of a code type (e.g. JavaScript code for Pinterest widgets) and to save people the need for template edits.
Everything works as expected, but I'm unsure on one thing. Since code is placed into this vB Options field, double quotes need to be escaped. I'm trying to make this as pain free for admins as possible, so I used
addslashes() to automatically escape the code.
PHP Code:
$find = '</body>';
$optioncode = $vbulletin->options['automediaembed_extras_body'];
$replace = addslashes($optioncode);
$vbulletin->templatecache['SHOWTHREAD'] = str_replace($find, $replace . $find, $vbulletin->templatecache['SHOWTHREAD']);
I figure I don't actually need to put automediaembed_extras_body in it's own variable, but I did so for neatness sake, as I hadn't actually settled on where to put the output when I started the plugin.
What I'd like to know is if
addslashes() is the best escape option here. Is it vulnerable to SQL injections, like I've been reading, in this context? I also had success with
mysql_real_escape_string(), but will that fail to escape some special characters that need to be escaped?
10-05-2013, 05:50 AM
Best Option for Escaping Double Quotes
Threaded Mode