We hope you enjoy your visit.

You're currently viewing our forum as a guest. This means you are limited to certain areas of the board and there are some features you can't use. If you join our community, you'll be able to access member-only sections, and use many member-only features such as customizing your profile, sending personal messages, and voting in polls. Registration is simple, fast, and completely free.


Join our community!


If you're already a member please log in to your account to access all of our features:

Username:   Password:
Add Reply
[php] Escaping Data
Topic Started: Jun 27 2005, 07:03 AM (523 Views)
Rory Jun 27 2005, 07:03 AM Post #1
i;m a mess
[ * * * * * * * ]
 Well, i was using addslashes() and stripslashes() when dealing with data from forms and stuff, but i read/was told that when inserting data into a database, using mysql_real_escape_string() was the one you should use.

So i have this function:

Code:
 
function escape_data($data) {
if (ini_get('magic_quotes_gpc')) {
 $data = stripslashes($data);
}
return mysql_real_escape_string($data);
}


Which all works fine and dandy when doing things like this:

Code:
 
$test = "\n\nwheeeee";
$test = escape_data($test);
echo $test;


where it outputs "\\n\\nwheeeee".

However, when i try and put that into a database, it just inputs "\n\nwheeeee". Which really doesn't help, because now my stripslashes when outputting data that has been queried from the database is without slashes at all.

Is it something to do with the mysql_real_escape_string() function that it doesn't actually input the escaped string? (that sounds really silly to me), or is there something else that is going wrong?

edit: Possibly this isn't actually problem? and i just shouldn't have stripslashes() unless i'm putting data into a form? Does that sound about right to anyone?
Offline Profile Quote Post Goto Top
 
Jeremy Jun 27 2005, 06:35 PM Post #2
Member Avatar
Member
[ * * * * * * ]
 What you're basically doing is escaping the "\n" so it doesn't become a line break in the MySQL Database. By escaping it, it's just adding the literal value of the escape process into the database, I think. Something weird about that function, or whatever...

Personally, I'd just use a custom function for escaping these things. Besides addslashes(), I don't like any of PHP's built-in escaping functions. :/
Offline Profile Quote Post Goto Top
 
Rory Jun 28 2005, 03:09 AM Post #3
i;m a mess
[ * * * * * * * ]
 what would a custom function involve? i'd have to regexp for loads of stuff wouldn't i?
Offline Profile Quote Post Goto Top
 
Jeremy Jun 29 2005, 09:09 PM Post #4
Member Avatar
Member
[ * * * * * * ]
 str_replace() will get most of them, I believe.
Offline Profile Quote Post Goto Top
 
The Legendary Sam Jul 5 2005, 06:49 PM Post #5
Feck j00, mate!
[ * * * ]
 \n will only parse if it is within a string. In your case, <br /> should work.
Offline Profile Quote Post Goto Top
 
1 user reading this topic (1 Guest and 0 Anonymous)
« Previous Topic · Technology Chat · Next Topic »
Add Reply