Escaping Characters

[sean04]

Hey,

 

So as of right now i'm escaping characters as follows:

 

$Name = htmlspecialchars(mysql_real_escape_string($_POST['Name']));

 

When I edit my name to something like this "Sean's" the output will be "Sean\'s"

I expected this but how can it just appear as "Sean's" but still escape characters?

I know there are some functions and stuff out there or ways around it..

 

Thanks,

Sean

 

[cags]

If you can visibly see the backslash character then it is being double escaped, this is probably because you have magic_quotes enabled on the server. You can use something like

 

if(get_magic_quotes_gpc()) {
   stripslashes($var);
}
$var = mysql_real_escape_string($var);

[Mchl]

Also htmlspecialchars should be called before mysq_real_escape_string, not the other way round.