_magic_

[RON_ron]

if( get_magic_quotes_gpc() ) {

$subjects = mysql_real_escape_string(stripslashes($_POST['subjects']));

$codeA = mysql_real_escape_string(stripslashes($_POST['codeA']));

} else {

$subjects = mysql_real_escape_string($_POST['subjects']);

$codeA = mysql_real_escape_string($_POST['codeA']);

}

 

I'm using the above to maintain the new paragraphs (when the user hits the Enter key). But unfortunately the back slashes are still appearing... Could someone help me here?

[ignace]

mysql_real_escape_string will add slashes for any character's (' and ") which could break your SQL. That said relying on mysql_* functions should be avoided and you should use the mysqli_* functions instead or PDO.

 

http://php.net/mysqli-real-escape-string

[PFMaBiSmAd]

the back slashes are still appearing...

 

Exactly where are they still appearing at?

[RON_ron]

I'm using this to store text in to the mysql db. the backslashes shows there.

[PFMaBiSmAd]

For us to be able to help you with any programming problem you are having, you must supply the all the relevant code and sample data needed to reproduce the problem. There's at least 6 different things I can think of that could cause the symptom.

[Adam]

Why not just disable magic quotes altogether?

[RON_ron]

Thanks. This is the full code.

 

if( get_magic_quotes_gpc() ) {

$subjects = mysql_real_escape_string(stripslashes($_POST['subjects']));

$codeA = mysql_real_escape_string(stripslashes($_POST['codeA']));

} else {

$subjects = mysql_real_escape_string($_POST['subjects']);

$codeA = mysql_real_escape_string($_POST['codeA']);

}

$update = sprintf("INSERT INTO newdb (subject, code) VALUES ('%s', '%s')", mysql_real_escape_string($subjects), mysql_real_escape_string($codeA));

$result = mysql_query($update);

[Adam]

You're escaping the variables again:

 

$update = sprintf("...", mysql_real_escape_string($subjects), mysql_real_escape_string($codeA));

[ignace]

That's how it should be done:

 

if (get_magic_quotes_gpc()) {
    $_POST['subjects'] = stripslashes($_POST['subjects']);
    $_POST['codeA'] = stripslashes($_POST['codeA']);
}
$update = sprintf("INSERT INTO newdb (subject, code) VALUES ('%s', '%s')", mysql_real_escape_string($_POST['subjects']), mysql_real_escape_string($_POST['codeA']));
$result = mysql_query($update);

[RON_ron]

Cheers All!!

 

mysql_real_escape_string ...relying on mysql_* functions should be avoided ...

 

http://php.net/mysqli-real-escape-string

 

I'm not really a php star - may I know briefly why? isn't this secure using mysql_real_escape_string?

[ignace]

http://php.net/mysql-real-escape-string

 

Look at the big red box