[SOLVED] slashes and database

[davidsakh]

I'm trying to break my database. I was able to successfully insert:

 

blah? "lol" 'wee''

 

into the database, so I think I'm cleaning the strings properly, but when I print it out for the user inside of an input field, 'wee' isn't displayed, because the slashes aren't added.

 

in the source, i see:

 

value='blah? "lol" 'wee'' />

 

so, I addslashes(), and this works, but the user sees slashes around "lol" when I don't want her to.

 

Any help would be greatly appreciated. Security is not my strong point.  :-\

[kenrbnsn]

When displaying data that contain quotes you need to use the function htmlentities with then ENT_QUOTES option:

<?php
$str = 'blah? "lol" ' . "'wee'";
echo '<input type="text" value="' . htmlentities($str,ENT_QUOTES) . '">';
?>

 

Ken

[davidsakh]

When displaying data that contain quotes you need to use the function htmlentities with then ENT_QUOTES option:

<?php
$str = 'blah? "lol" ' . "'wee'";
echo '<input type="text" value="' . htmlentities($str,ENT_QUOTES) . '">';
?>

 

Ken

 

prompt and dead-on. It works.

 

I apologize for my stupidity. Thanks.