fread() and quotes

[rubing]

I am writing a simple php autoresponder (email) script, which reads in email using fread().

 

#!/usr/bin/php -q
<?php
$fd = fopen("php://stdin", "r");
$email = "";
while (!feof($fd)) {
$email .= fread($fd, 1024);
}
fclose($fd);

 

I want to know if php can handle the use of quotation marks ' or " when assigned to a variable?  Does it automatically escape these and other bad characters (eg ; ) ??? 

[puritania]

Yes. It automatically escapes it when saving content into variables.

[rubing]

Yes, I figured it must've been doing that, but was confused b/c i still needed to escape these characters before inserting into mysql.  I guess php automatically strips the slashes too!

[puritania]

You didn't say anything about writing into mysql. To write a string properly in a database you have to do the following:

 

$str = 'This is " a test with \' Quotes';
mysql_query("INSERT INTO `table` SET `column` = '" . mysql_real_escape_string($str) . "'");