Help With mysql_real_escape_string

Immsy · 7 Jan 2010 at 19:33

I am using mysql_real_escape_string on anything that the user inputs that is entered into my database which deals with things like ' and such in words. When I output what I have saved in the database all the ' are shown as \'. Should I be running stripslashes () on the output?

Another strange occurance is that the ' is only shown as \' on my webspace but when running localally with xampp it outputs correctly as '.

Can anyone shed any light on this?

Thanks

NathanT · 7 Jan 2010 at 22:02

Looks like a magic_quote issue (where one server has the variable on and the other off or one is out of date)
I was under the impression that this function was depcreciated and more recently removed due to the issues that people had.

suarve · 8 Jan 2010 at 09:26

Code:

[COLOR=red]i f(get_magic_quotes_gpc())
	echo stripslashes($_POST['data']);
else
	echo $_POST['[/COLOR][COLOR=red]data[/COLOR][COLOR=red]'];[/COLOR]

Immsy · 8 Jan 2010 at 17:47

Thanks for the replies, thats what I ended up doing, stripslahes and then mysql_real_escape_string on the database queries.

marc2003 · 8 Jan 2010 at 18:12

i'd use an .htaccess file to turn off magic quotes. then you wouldn't have to bother with that if/striplashes nonsense.

Code:

php_value magic_quotes_gpc off

suarve · 9 Jan 2010 at 14:20

marc2003 said:
i'd use an .htaccess file to turn off magic quotes. then you wouldn't have to bother with that if/striplashes nonsense.

Code:

php_value magic_quotes_gpc off

Thought that only worked if that went into your httpd.conf file????

marc2003 · 9 Jan 2010 at 14:37

nope.

http://php.net/manual/en/configuration.changes.php

When using PHP as an Apache module, you can also change the configuration settings using directives in Apache configuration files (e.g. httpd.conf) and .htaccess files. You will need "AllowOverride Options" or "AllowOverride All" privileges to do so.

if you have access to php.ini/httpd.conf then of course there is no need for it. but i find it handy because it's quick, easy and portable (assuming your host supports it)

furnace · 9 Jan 2010 at 20:40

If your host doesn't allow you to disable magic quotes, leave them and go somewhere where they know what they're doing. You've got to be a pretty prehistoric creature to think they're a good idea