visitor enters text into database from a form

Anon

Hi,

Can you tell me how to check for any 'illegal' characters.

For example, This is a "cool" place to get help on 'php' coding.

I'm using a form action posting to my the MySQL database, at the moment results are coming back trucated with \ although when I look at the record in the database It show the above example perfectly.

Thanks

Anon

The example you give is occurring because of the magic_quotes setting in your php.ini file. With magic_quotes on, PHP escapes quotes with a backslash so that they can be entered into your MySQL database without an error. Read the comments in the magic_quotes section of your php.ini file if you need more info.

Are single and double quotes the 'illegal' characters you need to screen out, or are there other characters, also?

Anon

This forum probably uses htmlspecialchars() so no links, etc. can be added, but all < and > are echoed as they were intended.

If you want users to add limited html tags, use strip_tags()

Anon

I don't want anything that could screw up the database, so just basic characters should be allowed. I'm trying to build a search engine, and users are required to enter a description. This is were the problems arise, especially with the double quotes. There are probably others but I don't know, but double quotes are probably the only ones I would like to allow, as they seem to be used a lot in regular expressions.

Thanks

Anon

Links would not be allowed as this will be a description for a link in a search engine. Should I be using ereg() or something similar, and if so, does anybody have a snippet I could use.

Thanks

Anon

There are two possible problems here:

(1) characters that will mess up the database INSERT statements.
This is hopefully limited to ', ", and \ and will be handled automatically
if magic quotes are on. If they aren't then you need to use
addslashes() on the data before you add it.

(2) html tags you might not want to include in the data (even though
the database won't have any trouble accepting them.) As already
mentioned, strip_tags() will do this for you.

Anon

The problem I seem to have is that when I get the data back it stops when it gets the the first double quote. (It accepts the input of double quotes fine, so I guess magic quotes are on). Is there a way I can get the data back exactly the same as it way input into the datbase.

IE: This is a "cool" website.

This is insert into the database (with magic quotes on) as This is a "cool" website.

When I get the data back, it displays as This is a \

Is there a way that I can get it back as This is a "cool" website.

Thanks

Anon

$str = stripslashes($str)

???

i cant seem to add data with quotes and its killing me!