limitphp Posted February 19, 2009 Share Posted February 19, 2009 If I wanted to let users include single quotes as part of their playlist names, how would I safely allow them to do that? ex) $playlist = "60's Rock" Because, right now, I mysql_real_escape_string() values. I assume you should always mysql_real_escape_string() any user input, so how would I allow them to safely enter a single quote as part of their playlist name? Quote Link to comment Share on other sites More sharing options...
premiso Posted February 19, 2009 Share Posted February 19, 2009 You answered your own question. That is the best way to do it, if this is going to actually be a filename, I would not allow it. If it is only stored in a database, it is fine with ' etc. Just escape the data with the mysql function. Quote Link to comment Share on other sites More sharing options...
limitphp Posted February 19, 2009 Author Share Posted February 19, 2009 You answered your own question. That is the best way to do it, if this is going to actually be a filename, I would not allow it. If it is only stored in a database, it is fine with ' etc. Just escape the data with the mysql function. No, playlists will not be filenames. They are just going to be in stored in the database. So, when you mysql_real_escape_string() a value, it converts all single quotes into \' Does the \' get stored in the database like that? With the backslash? I'm confused, when you use the escape string(), what gets stored in the database? a single quote or a backslash and single quote? Quote Link to comment Share on other sites More sharing options...
Prismatic Posted February 19, 2009 Share Posted February 19, 2009 You answered your own question. That is the best way to do it, if this is going to actually be a filename, I would not allow it. If it is only stored in a database, it is fine with ' etc. Just escape the data with the mysql function. No, playlists will not be filenames. They are just going to be in stored in the database. So, when you mysql_real_escape_string() a value, it converts all single quotes into \' Does the \, get stored in the database like that? With the backslash? Yes. When you recall the data from the database run stripslashes() on it to remove them. Quote Link to comment Share on other sites More sharing options...
premiso Posted February 19, 2009 Share Posted February 19, 2009 So, when you mysql_real_escape_string() a value, it converts all single quotes into \' Does the \, get stored in the database like that? With the backslash? Haven't we gone over this like 3 or 4 times before? No, it just escapes it so it will not show up like \' in the DB. As long as magic quotes are turned off and you are not double escaping it. EDIT: Saw the stripslashes post. No, you should never use stripslashes on data coming out of a database. If you have to, it means you did not insert it properly/double escaped it. Read up on Magic Quotes as that is usually the cause of double escaping. I suggest it to be turned off. Quote Link to comment Share on other sites More sharing options...
limitphp Posted February 19, 2009 Author Share Posted February 19, 2009 sorry, I get confused easily. Having two little kids who keep you up at night makes your brain function at like 60% normal capacity. Ok, so, I escape it, it turns it into \' but in the database it stores it as ' only. thanks.... Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.