[Zenoxio]

I have a site where a user can enter data into a field, which is then stored into a database. I am using htmlspecialchar and addslashes to prevent XSS and SQL injection.

The problem is that if I enter Japanese characters, htmlspecialchar ends up doing something wrong to them. I think the chars are stored via Unicode, and it's taking the & and changing it into & which is then unrendering the Japanese when it is displayed on the webpage.

Any clues how I should go about this?

[brendandonhu]

Have you tried setting the charset parameter to htmlspecialchars()? It should be SJIS or EUCJP for Japanese: http://php.net/htmlspecialchars

[Zenoxio]

Is that okay to do if the data is primarily English, but may contain Japanese?

[brendandonhu]

It should be whatever character set the data is encoded with, I suppose you'd have to try it and see if it works for your data.

[Zenoxio]

How would I check what char set the data is? Do you mean the input box? That doesn't have a char set on it (that I specifically set).

[brendandonhu]

The character set is what the user enters in the input box. I am not really sure if setting it to Japanese in htmlspecialchars() will fix this problem, but it's worth trying.