Disabling/workaround single quotes (ie. ')

George_W__Bush

Hello to you,

Well, I have been pulling my hair out - I now look like the Golum from the Lord of The Rings - in trying to somehow fix the single quote (') problem encountered in PHP.

I would like to be brief and straight to the point. There is a page with a text field which allows one to type in ANYTHING they want. Upon pressing the "continue" button I send them to another page where the details of that text field are written to another page. They can input HTML like tags (ie. <b> and so on) and this is not applied to the text they have inputed but rather written as text. They can press the ENTER key for line breaks. These line breaks are visible in this subsequent page - which in some way is a preview page.

The below code takes the variable "address" (ie. the field name of the text area) and it does a replace of the HTML tags into the ASCII value. I also allow breaks (by pressing ENTER) to show up in this second (this preview) page - see line 3 below. The single quote is printed to the page - without breaking the HTML or the PHP code because of the replace seen in line 4. I then also remove all slashes () which are usually added to special characters such as $, / and double quotes (").

$address = ereg_replace( "<", "<", $address );
$address = ereg_replace( ">", ">", $address );
$address = preg_replace("/(\015\012)|(\015)|(\012)/"," <br>",$address);
$address = ereg_replace("'", "& #039;", $address);
$address = stripslashes($address);

The step above works fine.

On this second page they press another button - this sends the information to a mySQL database. Do I need to do any other "ereg_replace" on this field before the data is inputed in the database?

The problem is when I try to edit this field using a browser. Everytime I try to edit this field, which can contain the single quote, the PHP code breaks off.

I would like to pull the information to be editable from the database which is easy on the eye and friendly to a user - say, instead of seeing \' for every instance of ', I would like to actually see '

ie. Conno'r instead of Conno\'r in the editable field which pulls the value of field from mySQL.

Also, in this editable field, the <br> tag is present but instead I would have expected to see actual breaks.

As an overview, when one inputs in the insert text area such as:

<b>Conno'r</b> is super.

I like Conno'r.

I am able to properly print to anothe page the identical code (even HTML tags are written - and this is ok) so that it looks like:

<b>Conno'r</b> is super.

I like Conno'r.

I then insert the data in a database.

When I try to pull this data from the database into a field to be edited, the text that I can pull is - which is difficult to read.

<b>Conno\'r</b> is super. <br><br>I like Conno\'r.

I would like to be able to pull the data from mySQL so that in the editable field shows like:

<b>Conno'r</b> is super.

I like Conno'r.

I am not sure what other ereg_replace or other functions should I be using, or what does one need to do to make the field show fine without breaking the HTML or PHP code.

Thank you for your attention and assistance.

khaldryck

just do a stripslashes() before echoing your vars from the database

George_W__Bush

Here is the mySQL command to pull the data from the dB. I then echo the values into the text fields - the problem is that to code breaks when there are ' present.

I then escaped the ' by adding slashes to it so it looks like: \'

But would like to get rid of the slashes \ when I pull this data in the field to be edited (the comments field).

How would one apply the stripslashes to the echo as I try to populate the field with the mySQL data?

Take a look at the mySQL query below, and then at the form which is populating the field with the dB data.

Thank you.

$query="SELECT comment, FirstName, LastName FROM personal WHERE FirstName='$first_name' AND LastName='$last_name'";

$result = mysql_query($query) or die ("Error in query: $query. " .mysql_error());
if (mysql_num_rows($result) > 0)
{
$row = mysql_fetch_object($result);
?>

<FORM>
First Name
<input type="text" name="first_name" value="<? echo $row->FirstName; ?>">
<br>
Last Name
<input type="text" name="last_name" value="<? echo $row->LastName; ?>">
<br>
Comment
<TEXTAREA NAME="comment"><? echo $row->comment; ?></TEXTAREA>
<br>
</FORM>

😉

George_W__Bush

Any suggestions as to how I would approach this? Thank you.