Escaping quotes and backslashes

syst3m

I made a contact form and I noticed that if the user puts a " or a ' or a \ that it will be escaped. I tried putting & + quot; and the codes that generate those characters, but the emails are sent as plaintext so it didn't do anything. How can I get past this? I want to have normal quotes and backslashes.

jpmoriarty

turn off magic quotes in your php ini.

You should make extensive use of htmlspacialchars(), addslashes() and stripslashes() when dealing with data that other people post.

syst3m

Is there a way to have PHP mail sent as HTML?

syst3m

htmlspecialchars(); isn't working.

jpmoriarty

could you be any more vague?

what's not working in it

batman

Yes, you can have php mail html.
Here's how:

Put all the original coding above this.


$recipient = "your email";
$subject = "subject";


$headers = "From: YOU<your email>"; 

$headers .= "MIME-Version: 1.0\r\n"; 

$boundary = uniqid("HTMLDEMO"); 

$headers .= "Content-Type: multipart/alternative" . 
   "; boundary = $boundary\r\n\r\n"; 

 $headers .= "--$boundary\r\n" . 
   "Content-Type: text/html; charset=ISO-8859-1\r\n" . 
   "Content-Transfer-Encoding: base64\r\n\r\n"; 
$headers .= chunk_split(base64_encode("<html>Your html here!</html>")); 


mail("$recipient", "$subject", "", $headers);

That should do the trick. Just be sure to change all the variables.

-Blake

batman

There is another way also to do what you want by making it to where it won't delete your special characters.

Do this:


$yourvar = 'how ever you call the variable';

$yourvar2 = htmlspecialchars($yourvar);

Then you can do whatever you want with $yourvar2. 😃

-Blake