Sending Quotation marks without slashes

[Soffrite]

I'm kind of new to php, and have found a frustrating problem for me that is probably simple to get around (I hope!).

I have a script that allows site admins to log in and update the header and footer of the page and save them to a file to be included in all the php pages. However, whenever someone puts a quotation in the html, it puts a \ in front the the quotation and the page doesn't look right when loaded.

Ex.-

<img src=" would get <img src=\"

Here is a simple script I've made to show what I'm looking at:

Update the Footer:<p>
<?php

$form="
<FORM METHOD=post ACTION=$PHP_SELF ENCTYPE=multipart/form-data>
<input type=hidden name=go value=yes>

<TEXTAREA NAME=footer COLS=80 ROWS=9 WRAP=virtual>

</TEXTAREA>


<P><INPUT TYPE=submit NAME=submit VALUE=Update></p>
</FORM><p>
";

if ($go != "yes")
{
	echo "$form";
}
else if ($go == "yes")
{
	$filename = "/home/user/public_html/data/footer.html";

$newfile = @fopen($filename, "w+") or die("Couldn't open file.");

@fwrite($newfile, $footer) or die("Couldn't write to file.");

$msg = "<P>Footer updated successfully.</p>";
}

echo "<p>The current footer:<p>";
include("/home/user/public_html/data/footer.html");


?>

If anyone could help me out, or show me a different way to get this done, I'd really appreciate it.

[Option]

you could use single quotes in your html so <img src=" could be <img src='

OR

its not good practise but the quotes in html can usually be left out alltogether 😉

Thanks
Jonny

[HalfaBee]

You should NEVER display user input with using htmlspecialchars() or htmlentities() to expand the chars & " and others.

The way you have it anyone could trash your whole site.

HalfaBee

[Zack]

to get rid of those / before ", use stripslashes()

[Soffrite]

Thanks for the help and the pointer. I decided to go to database for security, and got rid of the / problem.

Thanks for your guys input 😃