rn's never die!

[dyr]

How can I get rid of the rn's?  I tried nl2br and it doesn't seem to work?

 

I use the function protect, which I defined here:

//SQL PROTECTION
function protect($value,$detect_numeric) {
  if (get_magic_quotes_gpc()) {
    if(ini_get('magic_quotes_sybase')) {
      $value = str_replace("''", "'", $value);      
    } else {
      $value = stripslashes($value);
    }
  }
  
  
  // Quote if $value is a string and detection enabled.
  if ($detect_numeric) {
    if (!is_numeric($value)) {
      return "";
    }
  }
  
  return mysql_real_escape_string($value));
}

 

Here's the entire code, mainly I'm looking at the reply areas. 

<?php

$title = "Compose New Message";
include $_SERVER['DOCUMENT_ROOT']."/inc/header.php";

if (isset($_GET['to']))
	$to = protect($_GET['to'], 1);
else
	$to = "";

if (isset($_GET['reply']))
	$reply = protect($_GET['reply'], 1);
else
	$reply = "";

if ($reply)
{
	$grab = mysql_fetch_array(mysql_query("SELECT `from_mid`, `subject`, `message` FROM inbox WHERE id='$reply' AND to_mid='$mid' LIMIT 1"));
	$to = $grab['from_mid'];
	if ($grab['subject'])
	$replysubject = "Re: ".stripslashes($grab['subject']);
	if ($grab['message'])
$replymessage = "-----------------------------------------------

".stripslashes($grab['message']);
}

function sendMsg($to, $subject, $message, $reply, $mid)
{
	$to = protect($to, 1);
	$subject = protect($subject, 0);
	$subject = htmlentities($subject);
	$message = protect($message, 0);
	$message = htmlentities($message);
	$reply = protect($reply, 1);
	$mid = protect($mid, 1);

	if (!$to)
		return error("You must enter a user to send a message to.");

	$countblocks = mysql_num_rows(mysql_query("SELECT `id` FROM blocks WHERE `mid`='$to' AND `user`='$mid' LIMIT 1"));
	$countblocks2 = mysql_num_rows(mysql_query("SELECT `id` FROM blocks WHERE `mid`='$mid' AND `user`='$to' LIMIT 1"));

	if ($countblocks)
		return error("This user has blocked you.");

	if ($countblocks2)
		return error("You have blocked this user.");

	//if ($to == $mid)
		//return error("You can't message yourself.");

	if (!$subject)
		$subject = "No Subject";

	if (!$message)
		return error("You must enter a message to send.");

	$check = mysql_fetch_array(mysql_query("SELECT COUNT(id) AS numrows FROM inbox WHERE `to_mid`='$to' AND `from_mid`='$mid' AND `subject`='$subject' AND `message`='$message'"));

	if ($check['numrows'])
		return error("You have already sent this message.");

	if ($reply)
	{
		//MARK AS REPLIED
		mysql_query("UPDATE inbox SET status='2' WHERE id='$reply' LIMIT 1");
	}

	mysql_query("INSERT INTO inbox (`to_mid`, `from_mid`, `message`, `subject`, `datesent`)
	VALUES ('$to', '$mid', '$message', '$subject', NOW())");

	echo success("You have sent this message successfully.");
	echo "<br /><center><a href='/inbox.php'>Return?</a></center>";
	include $_SERVER['DOCUMENT_ROOT']."/footer.php";
	exit;
}

if (isset($_POST['sendmsg']))
	$error = sendMsg($_POST['tomid'], $_POST['subject'], $_POST['message'], $reply, $mid);
?>
<center>
<?php if ($error) echo $error."<br /><br />"; ?>
<form method="post">
<table width="500" cellpadding="3" cellspacing="3">
	<tr>
		<td align="right"><b>To:</b>
		<td align="left">#<input type="text" name="tomid" value="<?php echo $to; ?>" size="5" /></td>
	</tr>
	<tr>
		<td align="right"><b>Subject:</b>
		<td align="left"><input type="text" name="subject" value="<?php if ($reply) echo $replysubject; ?>" /></td>
	</tr>
	<tr>
		<td align="right" valign="top"><b>Message:</b>
		<td align="left"><textarea name="message" rows="10" cols="50">
<?php if ($reply) echo "



$replymessage"; ?></textarea></td>
	</tr>
	<tr>
		<td align="center" colspan="2"><input type="submit" name="sendmsg" value="Send Message!" /></td>
	</tr>
</table>
</form>

</center>

<?php
//FOOTER includes
include $_SERVER['DOCUMENT_ROOT']."/footer.php";
?>

[dyr]

Tried testing again in various ways (taking out mysql real escape string, putting it back in, switching orders)  but the same thing happens.

[Barand]

nl2br insert an HTML line break before each return character (converts "\n" to "<br />\n");

 

<?php
$str = "Line1\nLine2";
echo "<pre>$str</pre>";

$str = str_replace("\n", " ", $str);
echo "<pre>$str</pre>";
?>

 

Result of above

Line1
Line2

Line1 Line2

[The Little Guy]

This will completely remove all \r and/or \n

 

// Gets rid of \r\n completely:
$source = preg_replace("/\r|\n/", "", $source);

[dyr]

forgot to list the grab function:

 

function memberGrab($value, $mid)
{

$mid = protect($mid, 1, 1);
$value = protect($value, 0, 0);

$result = mysql_query("SELECT `$value` FROM `users` WHERE `id`='$mid'")
or die ('cannot return member information' . mysql_error());
$row = mysql_fetch_array($result);

return stripslashes($row[$value]);

}

 

I tried putting your preg replace in the grab as well as protect function (like below) but it is still giving me rn's.  :/

 

return preg_replace("/\r|\n/", "", $row[$value]);

[Pikachu2000]

How about posting some of the actual data, before and after, as well as the code you're using to insert into the database to begin with. It seems like somehow you're ending up with literal backslash-r and backslash-n in the dataset somehow.

[dyr]

code I'm inserting in to database with:

function sendMsg($to, $subject, $message, $reply, $mid)
{
	$to = protect($to, 1);
	$subject = protect($subject, 0);
	$subject = htmlentities($subject);
	$message = protect($message, 0);
	$message = htmlentities($message);
	$reply = protect($reply, 1);
	$mid = protect($mid, 1);

	if (!$to)
		return error("You must enter a user to send a message to.");

	if (!$subject)
		$subject = "No Subject";

	if (!$message)
		return error("You must enter a message to send.");

	$check = mysql_fetch_array(mysql_query("SELECT COUNT(id) AS numrows FROM inbox WHERE `to_mid`='$to' AND `from_mid`='$mid' AND `subject`='$subject' AND `message`='$message'"));

	if ($check['numrows'])
		return error("You have already sent this message.");

	mysql_query("INSERT INTO inbox (`to_mid`, `from_mid`, `message`, `subject`, `datesent`)
	VALUES ('$to', '$mid', '$message', '$subject', NOW())");

 

data in:

hi

 

-------------------------------

 

data in database:

\r\n        hi    \r\n            \r\n            \r\n-------------------------

 

data out:

rnhi rn  rn  rn  rn----------------------

[Pikachu2000]

You shouldn't be seeing the actual \r\n's in your data. They are somehow being inserted as string literals, and I don't immediately see anything in the code that should cause it. You aren't actually typing the \r\n in a form field by chance, are you?