Why does this code do this?

Anon

The code below is for a guestbook that I have on my site here:

http://www.hypertheory.com/fenix/guestbook/guestbook.php3

For some reason, it is putting foward slash before every apostrophe. I went through the code line by line, but couldn't find the reason.

If any of u can see what's causing, could u please let me know?

Thanks,
Chris

Here's the code:

$PostPage = "post.htm";
$gbPage = "index.php3";

if (($name == "") AND ($email == "") AND ($comments == "")):

$error1 = "<font size='3' class='s4' color='red' face='Arial, Helvetica'><STRONG>It appears as if you've tried to submit a blank form:</STRONG></font><br>";

echo $error1;
include($PostPage);

elseif ($form == preview):
echo("

<head>
	<title>Untitled</title>
</head>
<style type='text/css'>
<!--//


.s5    {font-size: 20px; font-family: arial,helvetica}
.s4    {font-size: 18px; font-family: arial,helvetica}
.s3    {font-size: 13px; font-family: arial,helvetica; letter-spacing: 1px}

//-->
</style>

<BODY>

<P><font size='3' class='s4' face='Arial, Helvetica'>Confirm your comment and submit, or <a href='index.php3'>view the guestbook</a> without making an entry</FONT></P>

<P>
<font size='3' class='s4' face='Arial, Helvetica'>Add a message to my guest book:</FONT>

<FORM ACTION='guestbook.php3' METHOD=POST>
   <P>
<font size='3' class='s4' face='Arial, Helvetica'>
   Name:<BR>
   	<INPUT TYPE=text NAME=name SIZE=30 maxlength=80 value=$name><BR>
   Email:<BR>
   	<INPUT TYPE=text NAME=email SIZE=30 maxlength=80 value=$email><BR>
   Notes:

<BR>
	<TEXTAREA NAME=comments ROWS=10 COLS=30 WRAP=virtual>$comments</TEXTAREA>
<BR><BR>
   Check here if you used HTML tags in any field:&nbsp;&nbsp;<INPUT TYPE=checkbox NAME=html value='1'");if ($html == 1):$xbox = CHECKED; echo $xbox; else:'';endif;echo("><BR>




 </FONT>
</P>

   <P><font size='2' class='s3' face='Arial, Helvetica'><INPUT TYPE=submit NAME=gb VALUE='Add Message'>&nbsp;&nbsp;Please press only once: this may take a moment (or two).</FONT>
</FORM></P>




</BODY>

");

else:

$gbFile = "messages.txt"; // Location of link database file
$gbPage = "index.php3"; // Link page file

if ($html == 1):

$allowHTML = 1; // To allow HTML in site description 1 = Yes, 0 = No

else:

$allowHTML = 0; // To allow HTML in site description 1 = Yes, 0 = No

endif;

$notify = 0; // Would you like to be notified when a link is added? 1 = yes, 0 = No
$my_email = "you@youremailaddress.com"; // Enter your email address
$subject = "New Guestbook Entry" ; // Enter the subject of the notification email

/
Code Follows Below
/

$page = $gbFile;

if ($allowHTML == 0):
$name = ereg_replace("<","<",$name);
$name = ereg_replace(">",">",$name);
$email = ereg_replace("<","<",$email);
$email = ereg_replace(">",">",$email);
$url = ereg_replace("<","<",$url);
$url = ereg_replace(">",">",$url);
$urltitle = ereg_replace("<","<",$urltitle);
$urltitle = ereg_replace(">",">",$urltitle);
$referral = ereg_replace("<","<",$referral);
$referral = ereg_replace(">",">",$referral);
$comments = ereg_replace("<","<",$comments);
$comments = ereg_replace(">",">",$comments);

endif;

$filename = "messages.txt";
$fd = fopen( $filename, "r" );
$current = fread( $fd, filesize( $filename ) );
fclose( $fd );

$comments = ereg_replace("\n"," ",$comments);

$fileMessage = "Name: $name\n";

$fileMessage .= " Date: ";

$fileMessage .= ("\n");

$fileMessage .= (date("l dS of F Y h:i:s A"));

$fileMessage .= ("\n");

$fileMessage .= " E-mail:\n";
$fileMessage .= "$email\n";

// $fileMessage .= " Email: <a href=\"mailto:$email\">$email</a>\n";
//$fileMessage .= " Reference: <a href=\"$url\">$url</a>\n";
// $fileMessage .= " How did you hear about this site? : $referral\n";

$fileMessage .= " Comments:\n";
$fileMessage .= " $comments\n";

$fileMessage .= " <center><img src='black.gif' width=100% height=1 border=0></center>\n";
$fileMessage .= "$current\n";

if (file_exists("$page")):
$cartFile = fopen("$page","w+");
fputs($cartFile,$fileMessage);
fclose($cartFile);
else:
$cartFile = fopen("$page","w");
fputs($cartFile,$fileMessage);
fclose($cartFile);
endif;

// EMAIL THE NEW POST

if ($notify == 1):

$comments = ereg_replace(" ","\n",$comments);

mail
(
"$my_email",
"Example Issues List Entry",
"Name : $name
Email : $email
Note:

$comments\n
",
"From: $email\n"
);
endif;

//set vars for help checking against double entries

$name_chk = $name;
$email_chk = $email;
$comments_chk = $comments;

include($gbPage);

//endif from very top where checking if form is empty
endif;
</script>

Anon

Something got mangled during the posting, as your
sequence of ereg_replace()'s don't make any sense
as written:

$name = ereg_replace("<","< . . .

i.e. you're replacing the target pattern with the same thing.

Am I correct in suspecting that your code really says this?

$name = ereg_replace("<","&lt; . . .

At any rate, there's much easier ways of doing this. If
you just want the tags to disappear, you can say

  $name = strip_tags( $name );

You can also add a second argument for allowable tags
to leave in (typically innocuous things like and .)

If, on the other hand, you want to preserve the html
tags, but to "quote" them so they text displays with them visible
rather than acted upon, you can use Htmlspecialchars() or
Htmlentities().

Anon

Your text has all of the quotes escaped because magic_quotes is probably on. IT's on be default. It escapes all of the quotes to simplify putting the text into a database. Either turn magic_quotes off in PHP.ini, or run stripslashes($text) to get rid of the escapes...

---JH