addslashes() saga continues...

guido88

Ok -- Still no luck yet.

So, WHERE in this code should I add "addslashes()" in order for entries into my webform to be able to use " ' " marks (ie...Guido's Pizza, and not Guidos -- or Smith's Beer Hall, not Smiths). Check it:

<?php

if ((!$title) || (!$description) || (!$keywords) || (!$url) || (!$email) || (!$location) || (!$channel)) { header("Location: http://www.dstco.com/mithra/add_url.htm");
exit;
}

/ Title, Description, Keywords should have addslahes() capability. /

<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Added Record</title>
</head>

<body>
<H1>Site Submission</H1>

<?php

$sql = "INSERT INTO url_store VALUES (title, description, keywords, url, email, location, channel);

$connection = mysql_connect("localhost","abcde","123456789") or die ("Couldn't connect to server.");

$db = mysql_select_db("abc_123", $connection) or die ("Couldn't select database.");

$sql_result = mysql_query($sql,$connection) or die ("Couldn't execute query.");

if (!$sql_result) {
	echo "<P>Couldn't submit URL!";
} else {

echo "

<P>Site Submitted! Please allow up to 4 weeks for your submission to appear in our database.</P>

<table cellspacing=5 cellpadding=5>
<tr>
<td valign=top<strong>URL Title:</strong></td>
<td valign=top>$title</td>
</tr>

<tr>
<td valign=top<strong>Description:</strong></td>
<td valign=top>$description</td>
</tr>

<tr>
<td valign=top<strong>Geographical Location:</strong></td>
<td valign=top>$location</td>
</tr>
</table>

	";
}

</body>

First one to help me gets a free beer if they visit Prague. 🙂

Guido

Anon

Use addslashes sometime before you send the information in the variables to the database. if magic_quotes_gpc is enabled, PHP will automatically add the slashes.

I don't know if this will help you or not, but I have been using the following in my scripts and it sort of makes things a bit easier for me. It assumes you are using the POST method to retrieve your variables. I use this at the top if my main script so that it works as the variables are passed to the script.

//If magic_quotes_gpc is off, then addslashes to HTTP_POST_VARS, else do nothing
(get_magic_quotes_gpc()) ? null : array_walk($HTTP_POST_VARS,'my_add_slashes');

/
uses addslashes on all elements of $elem.
Called by array_walk if magic_quotes_gpc is 'off'
/
Function my_add_slashes(&$elem,$keys){
$elem = addslashes($elem);
}

I have also written a my_strip_slashes(), and use the same sort of conditional to run the variables through the strip_slashes routine before I print them to the screen.

cordex

mumble mumble But Prague is so far away.

Regardless, you've got all kinds of options. Let's put it here, though:
<?php
if ((!$title) || (!$description) || (!$keywords) || (!$url) || (!$email) || (!$location) || (!$channel))
{ header("Location: http://www.dstco.com/mithra/add_url.htm");
exit;
}
else
{
$title = addslashes($title);
$description = addslashes($description);
$keywords = addslashes($keywords);
$location = addslashes($location);
$channel = addslashes($channel);
}
?>

Not all of those fields may need it, but there you go.

cordex

Damn. No beer for me.
grin

-Ben