Strange PHP-MySQL Problem

[vvenomouss]

I am facing a strange problem while adding rows to MySQL, I googled alot but could not find a solution either. Here is an example:

 

$text = "hello \' \" hello';
echo $text; // prints hello \' \" hello as expected


$database->query("INSERT into table (madID, ad_text) VALUES (NULL, '$text')"); 

 

The entry is successfully added to the database but not with the slashes, it is added like:

hello ' " hello

 

I cant figure out why is Mysql removing those slashes, I have magic quotes turned off...

[wildteen88]

It may be your mysql class which is unescaping your quotes. What is the database class you're using?

[vvenomouss]

I am using the mysqli class without any modifications to it and I am getting the same problem both locally and on my server... 

[wildteen88]

You sure you're not calling any functions such as stripslashes before inserting your data into your query?

[mattal999]

$text = "hello \' \" hello';

 

This is invalid code. You never close string.

 

$text = "hello \' \" hello";

[vvenomouss]

Oh sorry that was a type in my example.. but in my actual code that is not the case.

 

$text = "hello \' \" hello';

 

This is invalid code. You never close string.

 

$text = "hello \' \" hello";

[vvenomouss]

No, I am not calling any stripslashes function, moreover if the actual string did not have the "\", mysql would not add it and return an error which means the string sent to Mysql is actually stripped...

 

I tried my example as:

 

$text = $_POST['something']; // without using addslashes ($_POST['something'] contained " & ')

 

and Mysql did not add the entry returned error

You sure you're not calling any functions such as stripslashes before inserting your data into your query?

[vvenomouss]

I just checked the following and yet again a strange behavior:

 

$text = addslashes("hello \' \" hello"); 
echo $text; // prints hello \\' \\" hello (as expected)

 

but to the database it adds:

 

hello \' \" hello

 

any idea?