[SOLVED] strip slashes function is not working

[cluce]

I am trying to error proof my web site but when I input a tag in the text field the tag still disrupts my web page. Can someone give me any suggestions?

It looks like I am using the strip slashes function correctly. Is their some other code I need to add to this? My trim function works fine but not the strip slashes. I even took out the trim function and still no go.  ???

 

here is my code

<?php
//initialize the session
if (!isset($_SESSION)) {
  session_start();
}

//connects to database
$mysqli = mysqli_connect("localhost", "root", "", "test");

//check to see if email exists in database/table
$usercheck = strip_tags(trim($_POST['username']));
$check = mysqli_query($mysqli,"SELECT email FROM auth_users WHERE email = '$usercheck' LIMIT 1"); 
$check2= mysqli_num_rows($check);

//if the email does not exist, it gives an error
if ($check2 != 0) {
    echo ("email exists");

     //create and issue the query
     //$sql = "SELECT username, password FROM auth_users WHERE email = '".$_POST["email"]."';
     //$res = mysqli_query($mysqli, $sql);
    	
    //$to = "cluce@reaganpower.com";
//$subject = "Website Inquiry Form";
//$body = "$sql";
//mail ($to, $subject, $body);
//header("Location: http:reaganpower.com/thankyou.html");

}else{
    $_SESSION['emailExists'] = "<font color='red'>The email"." ".$_POST['email']." "."does not exist in our database.<br>You may register for free by filling out the online registration form.</font>";	
header ("Location: forgot_password.php");
}

mysqli_close($mysqli);
?>

[taith]

um... ??? your not stripslasses()ing in there... ???

[cluce]

my mistake on the code.

 

 

this is what I have...

 

<?php
//initialize the session
if (!isset($_SESSION)) {
  session_start();
}

//connects to database
$mysqli = mysqli_connect("localhost", "root", "", "test");

//check to see if email exists in database/table
$usercheck = stripslashes(trim($_POST['email']));
$check = mysqli_query($mysqli,"SELECT email FROM auth_users WHERE email = '$usercheck' LIMIT 1"); 
$check2= mysqli_num_rows($check);

//if the email does not exist, it gives an error
if ($check2 != 0) {
    echo ("email exists");

     //create and issue the query
     //$sql = "SELECT username, password FROM auth_users WHERE email = '".$_POST["email"]."';
     //$res = mysqli_query($mysqli, $sql);
    	
    //$to = "cluce@reaganpower.com";
//$subject = "Website Inquiry Form";
//$body = "$sql";
//mail ($to, $subject, $body);
//header("Location: http:reaganpower.com/thankyou.html");

}else{
    $_SESSION['emailExists'] = "<font color='red'>The email"." ".$_POST['email']." "."does not exist in our database.<br>You may register for free by filling out the online registration form.</font>";	
header ("Location: forgot_password.php");
}

mysqli_close($mysqli);
?>

 

[taith]

and what are you getting from the $usercheck?

[cluce]

the first code was right.  I am not going to use a strip slashes function only the trim and strip tags.

[cluce]

when I add this input this in the text field...<tr>d<tr/>........It screws up the whole design. It looks unprofessional.

Again. I am using the strip tags function not the sstrip lashes.

[taith]

that would be because <tr>d<tr/> is not proper code... <tr><td>d</td><tr/>

[cluce]

your right. so I would error check that another way which I found. thanks

[cluce]

well I inserted proper HTML code this time and still screws up but I found another validation I am going to use. Thanks again