[SOLVED] Magic quotes disabled - now problems :(

[Yesideez]

I've turned off magic quotes using my .htaccess file now whenever I add anything to the database nothing is quoted.

 

I've tried...

if (mysql_query("INSERT INTO `guestbook` (`name`,`from`,`email`,`message`,`website`,`ip`,`added`) VALUES ('".ncode($strName)."','".ncode($strFrom)."','".ncode($strEmail)."','".ncode($txtMessage)."','".ncode($txtWebMessage)."','".getIP()."','".time()."')")) {

and this...

if (mysql_query(sprintf("INSERT INTO `guestbook` (`name`,`from`,`email`,`message`,`website`,`ip`,`added`) VALUES ('%s','%s','%s','%s','%s','%s','%d')",ncode($strName),ncode($strFrom),ncode($strEmail),ncode($txtMessage),ncode($txtWebMessage),getIP(),time()))) {

 

My "ncode()" function is this:

  function ncode($str) {
    return mysql_real_escape_string($str);
  }

 

I've tested with "it's" and no matter what I do I can't get "it\s" added into the database.

 

Even before I switched them off in the .htaccess file it was doing this.

 

Any suggestions?

[ranjuvs]

U can get that working with

function ncode($str) {
    return $str;
  }

 

but inorder to make your data safe, escaping is recommended.

[Yesideez]

I think you're missing my point - I *want* everything escaped properly which is why I've turned off the blasted magic quotes evilness and trying to use the proper function to do it - problem is - it doesn't seem to be working.

 

The only time it gets escaped is when I echo stuff straight to the browser. Use it anywhere else it doesn't work.

 

...and I can't figure out why not!

[Yesideez]

Anyone able to shed any light on this please?

[PravinS]

May this function will help you

 

function quote_smart($value)

{

// Stripslashes

if (get_magic_quotes_gpc())

{

$value = stripslashes($value);

}

// Quote if not a number or a numeric string

if (!is_numeric($value))

{

$value = "'" . mysql_real_escape_string($value) . "'";

}

return $value;

}

[Yesideez]

get_magic_quotes_gpc() will always return false as I've switched it off.

 

[Yesideez]

Anyone please?

[redarrow]

you can only use

 

example.....

$name=mysql_real_escape_string($_POST['name']);

 

then.

 

Dose it still not work.

 

 

also try this

$name=addslashes(mysql_real_escape_string($_POST['name']));

[Yesideez]

My function works fine when I just echo it to the browser:

echo ncode($strName);

I get the escaped text but as soon as I try and add it to my database the slashes disappear :/

[redarrow]

 

are u saying this doesent work.

 

function ncode($str) {
    return addslashes(mysql_real_escape_string($str));
  }

[Yesideez]

When adding data to the database - yes.

 

When echo'ing straight to the browser - no.

[redarrow]

have you got addslashes turned on or off in php.ini.

 

if off turn on then.

[Yesideez]

I tried it with it turned on - does exactly the same - no slashes added when I add it to the database.

[Yesideez]

I'll modify the script to dump some test data to the browser so you can see then I'll PM you a link.

 

I'd rather this not be made public at this time.

[redarrow]

understand ok

[Yesideez]

I'm about to PM you the link.

[PFMaBiSmAd]

When you turned off magic_quotes_gpc, it became necessary for your code to take over the responsibility of escaping the data, i.e. using the mysql_real_escape_string() function on string data.

 

The function that pbs posted will work no matter what your magic_quotes_gpc setting is and you should use something like his function because you won't always be on a server where you will have the ability to change the magic_quotes_gpc setting.

 

I tried it with it turned on - does exactly the same - no slashes added when I add it to the database.

The escape characters \ are not inserted into the database. When the query is executed, escaped characters are parsed and are converted to their literal un-escaped character. \' becomes ' in the database.

[Yesideez]

How can I get this working then?

 

Everything I'm trying is not working.

 

If I enter It\'s it goes in as It\'s.

 

Here's the sample output:

Straight from $_POST: It's
With my ncode() function: It\'s
With addslashes(): It\'s

[PFMaBiSmAd]

You would need to post the code you are using and if you are not using the code that pbs posted, you need to re-confirm what the current setting of magic_quotes_gpc is.

[Yesideez]

Just had a thought...

 

Could this be working properly then - still protecting against MySQL injection even though the database is removing the slashes?

 

magic_quotes_gpc is definitely off and I've done this in my .htaccess file with:

php_flag register_globals off
php_flag magic_quotes_gpc off

 

Read the $_POST value:

$strName=$_POST['name'];

Save in the database:

if (mysql_query(sprintf("INSERT INTO `guestbook` (`name`,`from`,`email`,`message`,`website`,`ip`,`added`) VALUES ('%s','%s','%s','%s','%s','%s','%d')",ncode($strName),ncode($strFrom),ncode($strEmail),ncode($txtMessage),ncode($txtWebMessage),getIP(),time()))) {

Contents of ncode():

  function ncode($str) {
    return mysql_real_escape_string($str);
  }

[premiso]

Yep that should protect you. You are escaping the strings, I see no reason why that would not work.

 

The database removes the slashes because it only "Escapes" them. This is nice cause when you pull the data out of the database to display it, you do not have to stripslahes on that data. It is sort of like when you echo something onto the screen like this:

 

echo "Hello world \"quote\"";

 

That will display Hello World "quote" because the slashes are just escaping the character to prevent an error.

[Yesideez]

Thanks!

 

It was causing me a massive headache.

 

I remember reading that PHP 6 has removed the magic quotes thing because of the amount of problems it caused.

[premiso]

Thanks!

 

It was causing me a massive headache.

 

I remember reading that PHP 6 has removed the magic quotes thing because of the amount of problems it caused.

 

The issues it caused could have been easily avoided by using stripslashes then the mysql_real_escape function if magic quotes were on. But yes, it promoted bad coding and alot of people found it hard to understand exactly what was happening. And most people thought, like you, that slashes should be in the database escaping the data, when in actuality they shouldn't.

 

But it is a good to start coding for the future =) If, however, you are making a distribution script. I would make your function like this:

 

<?php
function myEscape($string) {
     return (get_magic_quotes_gpc())?mysql_real_escape_string(stripslashes($string)):mysql_real_escape_string($string);
}

 

That way it will not matter if it is on or not on their server, everything gets escaped properly.

[Yesideez]

Distribution - I'll be sure to keep that in mind