Apostrophes in forms

La_Parka

I have a PHP-MySQL search script which uses a post form to get input. I have the stripslashes() function set so that slashes are not added to the keyword when quotes are used (the search results page displays the text "Results for $keyword"), but if the user types an apostrophe, a bevy of errors are returned, such as Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in path/to/search.php on line 75 and Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in path/to/search.php on line 83.

When stripslashes() is not used, slashes appear before both quotes and apostrophes. How can I strip the slashes on both without having the above errors for the latter?

DeltaRho2K

Something I have done in the past is to combine the addslashes() function with the stripslashes() function like so:

$fixedvariable = stripslashes(addslashes($variable));

Others on this board have other ways of doing this, and see this as a "redundant" way of handling this, but it works for me...

La_Parka

Originally posted by DeltaRho2K
Something I have done in the past is to combine the addslashes() function with the stripslashes() function like so:
$fixedvariable = stripslashes(addslashes($variable));
Others on this board have other ways of doing this, and see this as a "redundant" way of handling this, but it works for me... [/B]

Wouldn't this essentially have no effect on the variable? Is there a way to remove the slashes while still retaining functionality if the user enters an apostrophe as part of a search keyword?

DeltaRho2K

Like I said, others see this as redundant, and I can't explain why, but it works for me. The thought process behind it is that with addslashes(), it will always add the slashes, whereas without, it may miss something...

It doesn't hurt to try it. Worse case scenario, it won't work for you (and it may be some stupid miniscule setting in the php.ini file or something that is different between you and me, because like I said; it works for me to do this)

jayant

do stripslashes when echo'ing anything, but dont use stripslashes when using it in mysql query.

$fixedvariable = stripslashes(addslashes($variable));

will act like nothing got done, no effect.