Urgent help with preg_replace and/or addslashes! pls!

[evo4ever]

Hi peaps! Im here trying to resolve a VERY annoying problem, ive had this for days now and its been my most fustrating problem! what I need to do is replace "double quotes" in a form text area to 'single quotes'. The user types in some text in the text area and once submitted it goes into a database and the text then gets viewed on the main page. The text also gets called from the database into a hidden field on the main page. Thats were the problem is... if the user puts "" in his post then the post wont display properly. (type="hidden" value="$posttext"). I'd need to either add a slash to make \" or replace " to '. I've tried all kinds of different codes, some of my own and some of others. None of em worked.

create_post.php db query code:

// setup data to insert	
	$postDate = $formdata['postDate'];
	$postSubject = $formdata['postSubject'];
	$postedBy = $formdata['postedBy'];
	$posttext = $formdata['posttext'];

I believe I have to put either addslashes or preg_replace in the post text db query string. Anyone got any suggestions in how to get it right??? thx.

[cgraz]

if they type something like

hello my name is "bob"

just use addslashes() like you said

$text = addslashes($text);

Then input into database. When you pull out, use stripslashes() to remove the slashes just before echo'ing.

[philipolson]

The last advice is not fully correct. There is never a need to use stripslashes() on data from a database unless you entered it in incorrectly. By incorrectly I mean by running addslashes() twice on it before entry. This is typically done when one uses both magic_quotes_gpc and addslashes() on the same data, do not do this. magic_quotes_gpc is a php directive that defaults to on in php.ini and it essentially runs addslashes() on all GET POST and COOKIE data for you already. So keep this in mind.

Regarding your question, read this faq:
http://www.php.net/manual/en/faq.html.php#faq.html.encoding

Essentially, use htmlspecialchars() before using the data as a form value.

[evo4ever]

so...

$posttext = $formdata(addslashes('posttext');

...will work?

Im not bothered about htmlspecialchars() or any other function! I just NEED this problem resolved! Alll I want is sample code from your guys to fix it! I don't mean to sound arrogant or rude, its just that this job has a dead line and money is involved! I would most appreciate your further help. Thx.

[philipolson]

Did you read that faq? It tells you exactly what to do, with an example and everything.

[evo4ever]

Hmm. My hidden feild calls the data from a database:

<input name="pt" type="hidden" id="pt" value="<?php echo $a_row["posttext"]; ?>">

How would I put in htmlspecialchars()? And will htmlspecialchars add a slash to every double quote?

[evo4ever]

Ok, i got this working.... to a certain extent....

1. news.php:

   <?php echo "<input name=pt type=hidden value=\"" . htmlspecialchars($a_row['posttext']) . "\">\n"; ?>
   

2. login.php:

   <?php
   	if($Submit=="Login"){
   		session_start();
   
   $statusCheck = check_login($HTTP_POST_VARS); 
   if ($statusCheck == "Admin" || $statusCheck == "Staff"){
   	session_register("statusCheck");
   	session_register("pt");
   	"$pt = $pt";
   	header("location: $headerid?pid=$pid");
   	}
   	}  
   
   ?>
   
   <?php echo "<input name=pt type=hidden value=\"" . htmlspecialchars($_POST['pt']) . "\">\n"; ?>
   

   3. edit_news.php:

      <?php
      	session_start();
      	if($action=="logout"){
      		session_unregister("statusCheck");
      		session_unregister("pt");
      		session_destroy(); }	
      	if (!session_is_registered("statusCheck"))
      		header("Location: login.php");			
      ?>
      
      <textarea><?php echo "$pt\n"; ?></textarea>
      

      Eveything suceeds in geting into the hidden feilds with the specialchars, but the text aint getting in the text area in the edit_new page! I't might be failing to put the text in a session variable on the login page or I need some kind of function on the edit_news page to get the text to echo in the text area. Any suggestions? Thx.
      
      PS: The linking path to the edit_news page is like this: news>login>edit_news. so you can see why im carrying data from the news page to the edit_news page!

[evo4ever]

YES!!! IVE FIXED IT! ALL SORTED NOW!!! AT LAST!!! FEELS RELEAVED Thx for all your help huys! 😃

I had to use echo $_SESSION["pt"] instead of echo "$pt\n" and it all worked nicely! I did have more trouble after that because in the textarea it showed the slashes \. I just used stripslashes() on the login and edit_news pages and it got rid of em! Problem 100% Resolved!

PS: don't know what id do w/o u guys! Thx again!