Escaping Characters Using Addslashes/mysql_Real_Escape_String

[Jagand]

Hi,

 

I am trying to insert data into MySQL. Input data is sometimes not very neat. For example "com – What". When I added addslashes, mysql_real_escape_string, I expected that these non standards characters be inserted as-is or with escape sequences. When I perform inserts, data in MySQL DB looks strange. For example, above example (com – What) transformed into "com – What". "didn’t stop" is not being escaped as "didn\nt stop". How do I make sure that data in MySQL database is proper and as expected?

[Christian F.]

You should only use mysql_real_escape_string () and not addslashes ()[/ic]. Certainly not both at the same time, as you're escaping the data twice up then. Which is what's causing the "didn\'t stop" problem.

 

The first problem, however, is caused by using different character sets in your system. Standardize everything on UTF-8, and make sure you use UTF-8 compatible functions whenever you try to manipulate strings. Reading these two articles should give you a start on what you need to do:

http://www.ibm.com/developerworks/library/os-php-unicode/index.html

http://kunststube.net/encoding

Edited September 23, 2012 by Christian F.

[Jagand]

Thank you Christian.

[Christian F.]

You're welcome.

[Jagand]

I tried copying and pasting content at http://www.arcticsta...u-shutdown-stor with various options such as

html_entity_decode, mysql_real_escape_string, htmlspecialchars, addslashes but nothing was working. I tried other option too ....

 

<?php

mb_language('uni');

mb_internal_encoding('UTF-8');

 

print html_entity_decode('input_content');

 

?>

 

Also, given below options in form but did not work. Am I missing something?

 

accept-charset

='utf-8' enctype="multipart/form-data"

Edited September 27, 2012 by Jagand

[Christian F.]

You shouldn't need html_entity_decode () or addslashes () at all, but there are some steps you've missed.

 

Step 1 is to ensure that the database tables are using UTF-8, which is normally done by specifying the DEFAULT CHARSET when you create them.

Step 2 is to ensure that he database connection between PHP and MySQL uses UTF-8, which is done with mysqli_character_set_name ().

Step 3 is to ensure that you inform the browser that you're sending UTF-8, done with header ('Content-type: text/html; charset=utf-8').

Step 4, which I'm uncertain whether or not you've completed, is to make sure that all functions you're using are multi-byte compliant and supports UTF-8.

 

Since you haven't posted any code that replicates this issue, or really shows what you've done so far, I'm afraid this is as much help as I can give at the present time. What you have posted looks correct, besides the superfluous html_entity_decode () call.

The most important thing is to make sure that every step and every system involved is explicitly told about what encoding you're using, otherwise problems like this will occur sooner or later.

[Jagand]

Oh, it now works. Thank you again.

[Christian F.]

You're welcome, glad I could help.