replace ' with \' and / with \/ in a string

[jasonc]

I have taken a look at php.net and find that i have to be carful with multiple replaces as the result could be not what is expected.

 

i wish to convert all

 

'  with  \'

and

/ with \/

 

also i need to know how to do the reverse of this.

 

\'  with  '

and

\/ with /

 

 

basically adding a \ to the start of each and every one of these two characters only.

 

what method should i use to do this.

[mrMarcus]

why do you wish to escape a forward slash /?  and what is your usage?  mysql_real_escape_string will automatically escape quotes when data is being queried against a database.  what is your reasoning for doing this?

[kenrbnsn]

The function addslashes with do the first and the function stripslashes will do the reverse.

 

For the second

<?php
$str = str_replace('/','\\/',$str);
?>

to add and

<?php
$str = str_replace('\\/','/',$str);
?>

to remove. You need two \ since the backslash is the escape character.

 

The real question is why do you want to do this?

 

Ken

[salathe]

Could you give some more context about how/where you need to do this (un)escaping? I have the sneaking impression that there could/should/might be a better way.

[jasonc]

i have a javascript ticker which says that i have to add a \ to every

 

' and /  for the ticker to work correctly.

[jasonc]

what should happen is i enter...

 

'hello'
"hello"
/hello/
\hello\

 

and the data stored should be...

 

\'hello\'
"hello"
\/hello\/
\hello\

 

 

then when the data is got back to edit it should be....

 

'hello'
"hello"
/hello/
\hello\

 

here is my code

 

it is storing the text in MySQL as

 

\'hello\'
\"hello\"
/hello/
\\hello\\

 

but should be

 

'hello'
"hello"
/hello/
\hello\

 

 

 

<p align="center"><strong><em><font size="4">Edit Ticker</font></em></strong></p>
<? include("admin/checkloggedin.php");
if (!$phpsession) { include("admin/loginbox.php");
	} else {
						if($_POST['Submit'] == "SAVE CHANGES") { // get info on return to page
										// convert all    '    to     \'		/    to     \/
										$ticker = $_POST['ticker'];
										echo("..".$ticker."..<br><br>");
										$charone = "'";	$charone_change ="\'";
										$chartwo = "/";	$chartwo_change ="\/";
										$str = str_replace($charone,$charone_change,$ticker);
										$str = str_replace($chartwo,$chartwo_change,$str);
										$ticker = $str;
						}

								if($_POST['Submit'] == "SAVE CHANGES") {
									$sql = "UPDATE `ticker` SET `ticker` = '" . db_input($ticker) . "'";
									$res = db_query($sql);
									echo("changes were saved");
								} else {
																		$sql = "SELECT `ticker` FROM `ticker`";
																		$res = db_query($sql);
																		$ticker = db_output(mysql_result($res, 0, "ticker"));
																		echo("..".$ticker."..<br><br>");
																		// convert all    \'    to     '		\/    to     /
																		$charone = "\\'";	$charone_change ="'";
																		$chartwo = "\\/";	$chartwo_change ="/";
																		$str = str_replace($charone,$charone_change,$ticker);
																		$str = str_replace($chartwo,$chartwo_change,$str);
																		$ticker = $str;
														?><form name="edit" method="post" action="?ac=admin&aac=et&phpsession=<?=$phpsession;?>">
														  <table width="100%">
															<tr> 
															  <td colspan="2" align="center"><textarea name="ticker" rows="20" cols="65"><?=$ticker;?></textarea></td>
															</tr>
															<tr> 
															  <td><div align="center"><input type="submit" name="Submit" value="SAVE CHANGES"></div></td>
															  <td><div align="center"><input type="button" name="Submit2" value="CANCEL CHANGES"></div></td>
															  <td rowspan="2"><div align="center"></div></td>
															</tr>
														  </table>
														</form>
														<? }
								}
	}
?>

[kenrbnsn]

It sounds like you have magic quotes turned on.

 

You should store raw data in your database and use the function mysql_real_escape_string when storing the data.

 

How are you sending the data to Javascript?  If it's with JSON, that should take care of the backslash quoting for you. If you're not using JSON, do

<?php
$ticker = str_replace(array("'",'/'),array("\\'","\\/"),$ticker);
?>

before you send the value to Javascrpt.

 

Ken