Turkish Character Issue in PHP and MS-SQL

gozlemci · 11-17-2011, 08:53 PM

Hi There;
As a hot volunteer of an open source initiative, I feel sorrow using MS-SQL and IIS. I could not convince boss to use mySQL, but anyway I can push PHP on boss.

I have a MS-SQL server and I have Turkish names in my table. User enters names and I send it to SQL server, print result to output. However, my PHP code process and prints text as a UTF-8, and send it to MS-SQL and print it to output.However data in MS-SQL is in Windows(Turkish) format, so there are nothing to return. For example;
when user types "Güray" in html input form, PHP issues a query:
"SELECT * FROM table WHERE name ='Güray' " and sends it to MS-SQL server. Server returns nothing, but I know that there are many entries that name attribute is 'Güray'.
But when name contains purely English characters, such as 'Ali' it works fine.

In addition, when I print result of query returned by MS-SQL via HTML , Turkish character in a string printed in a rectangle.

How can I overcome these two frustrating situations? Any help is greatly appreciated.

Snark1994 · 11-18-2011, 05:36 AM

You probably want to look at the PHP function mb-convert-encoding.

Also, what would happen if someone entered "Güray'; DROP TABLE table; --" as their name?

gozlemci · 11-18-2011, 06:10 AM

Thank you for your suggestions, I will be considering your function.
If the thing you've said will happen , it would be a great catastrophe

Snark1994 · 11-19-2011, 06:30 AM

Quote:

Originally Posted by gozlemci

If the thing you've said will happen , it would be a great catastrophe

Exactly

It might be a good idea to read up on preventing SQL injection attacks (there are many other sites on the web, which could be better than the one I found - search for 'preventing SQL injection' or similar in Google)

gozlemci · 11-19-2011, 10:00 PM

I can not even solve the problem. Any help is greatly appreciated.Here is the part of the code :

This code creates SQL word and connects to the database.The odbc_result_all_ex (phrase in red) prints the result.

Code:

 $virtual_dsn = 'DRIVER={SQL Server};SERVER=REHAB-EB07315EE\SQLEXPRESS;DATABASE=osman';
    $connection = odbc_connect($virtual_dsn,'sa','123456') or 
        die('ODBC Error:: '.odbc_error().' :: '.odbc_errormsg().' :: '.$virtual_dsn);

    /*
     * EN : Connecting to the database.
     */
    odbc_exec($connection,'osman');
    
    //# For experimental purposes
    echo $SQLSentence;
   
     /*
     * EN : Query is sending.
     */
    $result = odbc_exec($connection , $SQLSentence);

    if(!$result)
    {
        echo "Query failed " .odbc_error();
    }
    
    odbc_result_all_ex($result,'Border=1 cellspacing=1 cellpadding=5', "style='FONT-FAMILY:Tahoma; FONT-SIZE:9pt; BORDER-BOTTOM:solid 1pt gree'");

    sqlsrv_close($connection);

Contents of odbc_result_all_ex.The red is the nub:

Code:

       function odbc_result_all_ex($res, $sTable, $sRow)
    {
        $cFields = odbc_num_fields($res);

        $strTable = "<table $sTable>";
        $strTable .= "<tr>";
        
        for ($n=1; $n<=$cFields; $n++)
        {

            $strTable .= "<td $sRow><b>". str_replace("_", " ", odbc_field_name($res, $n)) . "</b></td>";

        }
        $strTable .= "</tr>";

        $temp;
        while(odbc_fetch_row($res))
        {
            $strTable .= "<tr>";
                for ($n=1; $n<=$cFields; $n++)
                {
                    if (odbc_result($res, $n)=='')
                    {
                        $strTable .= "<td $sRow>&nbsp;</td>";
                    }
                    else
                    {
                        $temp = mb_convert_encoding(odbc_result($res, $n), "UTF-8");
                        $strTable .= "<td $sRow>" . $temp . "</td>";
                    }

                }
            $strTable .= "</tr>";
        }

        $strTable .= "</table>";

        echo $strTable;

    }

I tried every encoding recognized in PHP, but I couldn't able to print Turkish characters properly.
Here is the code that lists the encoding:

Code:

$text = "Pijamalı hasta yağız şoföre çabucak güvendi."; //Turkish "The quick brown fox jumps over the lazy dog"; 

foreach(mb_list_encodings() as $chr){ 
        echo mb_convert_encoding($text, $chr)." : ".$chr."<br>";    
 }

Any help is greatly appreciated. I am in trouble.

Snark1994 · 11-20-2011, 07:43 AM

Only thing I can think of is to use HTML entities:

Code:

â = &acirc;
Â = &Acirc;
ç = &ccedil;
Ç =&Ccedil;
ğ = ğ
Ğ = Ğ
ı = ı
İ = İ
ö = &ouml;
Ö = &Ouml;
ş = ş
Ş = Ş
ü = &uuml;
Ü =&Uuml; 	  	 
î = &icirc;
Î = &Icirc;
û = &ucirc;
Û = &Ucirc;

You can then search through all your text, replacing any special characters with the above entities, which should then appear correctly regardless of character set. If you're doing text comparison with your database, you'll also need to convert all your database data to use these entities as well

Hope this helps,