php adds \ to my string!

[epimeth]

hmm....

This is the code I'm having trouble with... greatly simplified, of course...

$mystring = $_GET['mystring'];
echo $mystring;

given input:

hello world!

both machines display

hello world!

but... given input:

what's up, dubya!

machine A will respond with

what's up, dubya!

while machine B will respond with

what\\'s up, dubya!

this is not a good thing. besides the fact that it just doesn't look good, it also causes a fatal error since I'm not only outputting the input, I'm also using it as a searchterm in a mysql query....

any ideas???

[buraks78]

it is caused because of a setting in php.ini

if i do not remember incorrectly, it is called

gpc_magic_quotes

and it is yes by default...

i do not recommend turning it off because of security reasons.

instead use stripslashes function to remove the quotes ONLY WHEN YOU ARE ECHOING STH..

like

$mystring=stripslashes($_GET["stuff"]);
echo $mystring;

do not use this stripslashes if you are planning to use $mystring as a part of an sql statement. check this website for database security articles...

[buraks78]

it is caused because of a setting in php.ini

if i do not remember incorrectly, it is called

gpc_magic_quotes

and it is yes by default...

i do not recommend turning it off because of security reasons.

instead use stripslashes function to remove the quotes ONLY WHEN YOU ARE ECHOING STH..

like

$mystring=stripslashes($_GET["stuff"]);
echo $mystring;

do not use this stripslashes if you are planning to use $mystring as a part of an sql statement. check this website for database security articles...

[epimeth]

it doesn't actually work in the sql query, so I'll just strip them from the $_GET...

thanks!