Help Me Understand Quotes

partypete

Ok guys/gals, I'm a tad confused when it comes to quotes in database driven pages.

I'm building a site for a furniture business and one of their products are TVs let's say.

On my INSERT Record page in a (Product Title)text field I enter:

JVC 56" Television

This gets inserted just fine and I can display this Product Title on the products page just fine. The problem seems to be when I want to EDIT this information.

On my EDIT Record page, there is of course a text field the Product Title should appear in so I can edit it. The problem is that the text field only displays the Product Title up to the quotation mark like this:

JVC 56

But this same Product Title will appear properly if displayed in a "Text Area"!?!?!

Why won't this Product Title appear properly in a Text Field, but will display properly most other places?

I used htmlspecialchars() which seems to have fixed the problem, but I'd rather not have to do this to every Text Field that could have quotes. Is there a global solution to this, or maybe someone can just explain how to handle quotes better.

Thanks all!

Peter

lazzerous

tis easy

before you enter into the database

$var = addslashes($var);

and after you pull from the db:

$var = stripslashes($var);

partypete

Hey lazzerous,

While looking into add/stripslashes() I found magic_quotes_gpc(). This feature is ON at my host. So this does the same as what you were saying right?

I guess the confusing part is that quotations get inserted into the database fine, they can be displayed on a page fine, then can be displayed in a Text Area fine... so far the only thing I'm having trouble with is displaying quotations in Text Fields.

Why are quotations being displayed everywhere else fine, except in a Text Field?

Thanks again for the help!

yelvington

This is not a magic_quotes_gpc / addslashes / stripslashes problem.

The clue is that it works with TEXTAREA and not with an INPUT TYPE=TEXT.

It is a simple HTML problem that should be obvious if you view the HTML source for your page.

You can't do this:

planetsim

Originally posted by partypete
Hey lazzerous,

While looking into add/stripslashes() I found magic_quotes_gpc(). This feature is ON at my host. So this does the same as what you were saying right?

I guess the confusing part is that quotations get inserted into the database fine, they can be displayed on a page fine, then can be displayed in a Text Area fine... so far the only thing I'm having trouble with is displaying quotations in Text Fields.

Why are quotations being displayed everywhere else fine, except in a Text Field?

Thanks again for the help!

If they are on do this its a function i picked up somewhere

function strip_magic_quotes($arr) {

  foreach ($arr as $k => $v) {
	if (is_array($v)) { 
	  $arr[$k] = strip_magic_quotes($v); 
	} else { 
	$arr[$k] = stripslashes($v); }
  }

  return $arr;
}

if (get_magic_quotes_gpc()) {
  if (!empty($_GET)) { 
	$_GET = strip_magic_quotes($_GET);   

  }
  if (!empty($_POST)) { 
	$_POST = strip_magic_quotes($_POST);
  }
  if (!empty($_COOKIE)) { 
	$_COOKIE = strip_magic_quotes($_COOKIE); 
  }
}

This will avoid getting double slashes \"

Drakla

Everyone listen to Yelvington, he's spot on.

There's a helluva lot of confusion about the addslashes / stripslashes situation going around, and little note made of using htmlspecialchars either when putting the database into the DB if it's only ever going to be used as html output, or using it to display the data once you've sucked it out of the DB.

partypete

Thanks everyone,

I thought that was what was happening... the quotation ending the text field prematurely. But I was wondering why it didn't do the same thing to a text area. Yeah duh... I noticed the content of a text area is actually between html tags, not INSIDE one like a text field... oops! :rolleyes: Need sleeeeeep! Sorry.

So what would you recommend then. If a quotation may appear in a text field (input type="text"), what is the best way to make the quotation not end the text field. Right now I'm using htmlspecialchars() to convert the quotation to it's html equivalent. Would this be the best way?

Thanks, and sorry again!

Peter

laserlight

htmlspecialchars() converts the double quote into "

This is indeed what you want.
In fact, unless you can be sure that the text output cannot contain malicious code (e.g. a malicious javascript), htmlspecialchars() or htmlentities() should be used before output.

magic_quotes_gpc concerns escaping quotes in GET, POST and COOKIE (and environmental variables as well, I think) data.

Is magic_quotes_gpc is set to on, which by default it probably is, then quotes should be escaped automatically.

This is good in some cases, where escaping in this way will prevent SQL injection, e.g. on a mysql database.