guestBook

[Bickey]

I'm saving customer comments in an MYSQL. But the when I use mysql_real_escape_string() to filter the input data it's causing wired signs when it's displayed in the guest book. (E.g. whenever there is a ' sign, the output is \').

 

Is it safe to have a guest book without mysql_real_escape_string( or please suggest how should I go about creating this guest book on my website.

 

Thanks.

Bickey.

[msaz87]

Use stripslashes when displaying the comments

[Pikachu2000]

If stripslashes() is necessary, the problem is occurring when the data is inserted. You probably have magic_quotes_gpc() on in your php.ini and don't check for it before escaping the data for insert. You should set magic_quotes_gpc() to Off if possible.

 

If you can't, and/or you want the code to be as portable as possible, use an escaping sequence that checks for magic_quotes_gpc(), and if on, applies stripslashes() before escaping the data.

 

if( get_magic_quotes_gpc() ) {
     $data = mysql_real_escape_string(stripslashes($_POST['data']));
} else {
     $data = mysql_real_escape_string($_POST['data']);
}

[Bickey]

Thank you Pikachu2000.

 

I'll give it a try.