Escaping data prior to mysql

[graham23s]

Hi Guys,

 

i was wondering if anyone could tell me the best way to do this, i am doing a very basic blog, and when the user types in the blog post, the data is stripped of any problemtic ' or " and displays each break on a new line.

 

any advice/help would be great

 

cheers

 

Graham

[unidox]

http://templora.com/content/14

 

just do a google search.

[ILYAS415]

Okay theres 2 things you can do....

 

 

1). Convert the characters into friendly characters like in Pokemon ???

$string= htmlentities($_POST['nameofinputortextarea']);

 

2). Use this...

$string= str_replace("\"", "", $_POST['something']);
$string= stripslashes($string);
//then repeat for ' character

 

I would recommend the first one as its shorter and easier and hassle free.

[rarebit]

For the breaks, do you mean like this?

http://uk3.php.net/manual/en/function.nl2br.php

[graham23s]

Hi Guys,

 

yeah i originally used:

 

$string_to_clean = clean_junk($_POST['nameofinput'], 1);

 

function:

 

function clean_junk($string, $nlbr = false) 
{ 
   if (get_magic_quotes_gpc()) {    
        $string = stripslashes($string);
   }         
   if ($nlbr) {
        $string = nl2br($string);    
   }           
   return mysql_real_escape_string($string);   
} 

 

just curious as to whether there was an easier way to code it, this works mind you but always looking for new ways of doing things

 

cheers

 

Graham

 

[rarebit]

Other than htmlentities() at certain times, then yeah, looks good to me...