POST data and the / character

epimeth

I'm posting some data and using

$redirect = $_POST['Redirect'];
$fcontent = $_POST['FileContent'];

to retrieve it.

however, when I echo the contents of $fcontent, php seems to have added a \ character in front of every ', ", and \ characters. I tried using ereg_replace on the $fcontent string, but '\' is a
" unexpected T_CONSTANT_ENCAPSED_STRING "

so I created the function

function fixcontent($tofix)
{
	$fix1 = ereg_replace('\\\\', '~~~~~~~', $tofix);
	$fix2 = ereg_replace('\\', '', $fix1);
	$fix3 = ereg_replace('~~~~~~~', '\\', $fix2);
	return fix3;
}

to fix it, but I'm unhappy with it, since I might theoretically want to use ~~~ in my content somewhere. And this is true for any replacement for this.

Is there any way I can fix this?

[edit]
actually, that didn't work either....
when running

echo fixcontent($fcontent);

I get

Warning: ereg_replace() [function.ereg-replace]: REG_EESCAPE:2trailing backslash () in c:\inetpub\wwwroot\home\editfile.php on line 6

line 6 being

$fix2 = ereg_replace('\\', '', $fix1);

but you really can't trust notepad....
[/edit]

cgraz

try stripslashes()

Cgraz

jpmoriarty

and turn magic quotes off in your php ini file, and then use addslashes() and htmlspecialchars() on your post data in the future.

epimeth

thanks guys... especially for the htmlspecialchars()... I was begining to worry I'd have to search through every string I'm displaying for the special characters... I started out with only the < and >, but saw others coming to bother me in the future...

do you recon it would be better to turn magic quotes off, or to stripslashes() incoming data? I'm used to having to Trim(CStr()) or CInt() incoming data in ASP, so leaving magic quotes on doesn't really bother me, and since its on by default I don't feel comfortable changing what the developers seem to think is important.