[SOLVED] special characters

[timmah1]

I'm trying to allow the users to be able to write their own description of things.

The problem is, if they put ' or ", it don't go into the database.

 

I have this

$hint = mysql_real_escape_string($_POST['hint'][$i]);
$hint = addslashes($_POST['hint'][$i]);

 

but it's inserting the ' or " or anything after those characters.

 

How can I get these inserted?

 

Thanks in advance

[dennismonsewicz]

i would combine the vars...

 

$hint = mysql_real_escape_string(addslashes($_POST['hint'][$i]))

[DarkWater]

Don't use mysql_real_escape_string() AND addslashes().  Use the former.

[timmah1]

ok, I'm sorry, it is inserting into the database, but when it's retrieved into the text box, it don't show correctly in the text box.

 

Right now, I have this in the database

Order tonight\'s special

 

But when it's pulled back out into the text box, it only shows

Order tonight

 

How can I show it correctly?

 

I tried this

$hint = stripslashes($a[hint]);

 

[timmah1]

ok, i'll change it too

$hint = mysql_real_escape_string(addslashes($_POST['hint'][$i]))

 

 

[dennismonsewicz]

Don't use mysql_real_escape_string() AND addslashes().  Use the former.

 

Why not? just wondering...

[dennismonsewicz]

oh i see why not... mysql_real_escape_string prepends slashes... so the addslashes is not needed

[DarkWater]

Don't use mysql_real_escape_string() AND addslashes().  Use the former.

 

Why not? just wondering...

 

<?php
echo mysql_real_escape_string(addslashes("Some random stuff ' "));
?>
OUTPUT:
Some random stuff \\\'

 

It completely wrecks your backslashes by using both of them.

[dennismonsewicz]

Don't use mysql_real_escape_string() AND addslashes().  Use the former.

 

Why not? just wondering...

 

<?php
echo mysql_real_escape_string(addslashes("Some random stuff ' "));
?>
OUTPUT:
Some random stuff \\\'

 

It completely wrecks your backslashes by using both of them.

 

Thanks!

[timmah1]

ok, now how about displaying the information into the text box?

[dennismonsewicz]

try just using this

 

$hint = mysql_real_escape_string($_POST['hint'][$i]);

[timmah1]

ok, I'm sorry, it is inserting into the database, but when it's retrieved into the text box, it don't show correctly in the text box.

 

Right now, I have this in the database

Order tonight\'s special

 

But when it's pulled back out into the text box, it only shows

Order tonight

 

How can I show it correctly?

 

I tried this

$hint = stripslashes($a[hint]);

[DarkWater]

Can I see your code for putting it back into the textbox?  I'm 99% sure that you have it as a value="" attribute on a tag and you're not encoding the quote, so it's breaking the HTML.

[timmah1]

your right

echo "<input type='text' class='textfield' size='50' name='hint[]' value='$a[hint]'> </td>";

[timmah1]

ok

I have it fixed, thanks DarkWater

 

$hint = stripslashes($a['hint']);
echo "<input type='text' class='textfield' size='50' name='hint[]' value='", htmlentities($hint, ENT_QUOTES), "'> </td>";