[Resolved] unexpected problem with quotes

composer

Firstly, let me state the magic quotes is on.
I have an article management script, that performs perfectly correct i.e. quote marks in an article are handled correctly when added and retrieved from a database. The problem occurs when I retrieve for edit purpose.

The process is as follows: the article is retrieved from the db by its ID and displayed in a text area (quotes ok). An edit button event calls a second page that processes both an update and delete process

The second page makes a db connection and pulls the record by ID passed by the first page, but the text is displayed in a text area by retrieving the value from the form on the first page... and this is where there`s a problem.

Even though there is a valid text with quotes in the first page textarea, when that text value is retrieved by the second page, everything after the first quote mark doesn`t show - and I cannot understand why this is happening, as quotes have already been handled.

Has anyone else experienced this type of quote handling problem? or can anyone offer any assistance to remedy this?

Having spent days examining this code line by line, and being very inexperienced with php/mysql coding, I've had to admit defeat and seek help from the more experienced/experts.

TheDefender

I have seen this behavior before, and I believe it was resolved with addslashes() or stripslashes(), but I can't 100% remember. Post come code so we can take a look at it... I know you said magicquotes is on, and the quotes are already handled, but just humor me. 😉

composer

Thanks for responding, here are some relevant code snips from proc. pages:

first page: (returns quotes correctly from db)

print "<form action='modelete.php' method='post'>";
print "<input type='hidden' name='id' value='$r[EntryID]'>";
print "<input type='hidden' name='title' value='$r[title]'>";
print "<input type='hidden' name='shortdescription' value='$r[shortdescription]'>";
print "<input type='hidden' name='body' value='$r[body]'>";
print "<br><input type='submit' value='Delete Entry' name='submit'>";
print " <input type='submit' value='Edit Entry' name='edit'></form><br>";

modelete page: ($body terminates after first quote)

else if(isset($POST['edit'])) // if edit is pressed
{
$title=$POST['title'];
$sql="Select * from CMS_articles WHERE title='$title'";
$sql2=mysql_query($sql);
$row=mysql_fetch_array($sql2);
if(!$row)
{
print "<br><br><font color='red'>No such entry</font>";

    }
else //if entry exists
 {

print "<form action='edit.php' method='post'>";
print "<input type='hidden' name='id' value='$id'>";
print "Title: <input type='text' name='title' value='$title'><br>";
print "Abstract:<br><textarea rows='4' name='shortdescription' cols='25'>$shortdescription</textarea><br><br>";
print "Body:<br><textarea rows='15' name='body' cols='70'>$body</textarea><br><br>";
print "<input type='submit' name='editnow' value='edit'>";

}
}

edit page: (works fine and updates db with all quotes in place, and the update will view correctly when pulled from the db)

so..... the problem occurs when passing $body

TheDefender

I know this sounds kinda whacky, but humor me 😉 and make this change... (The thought process behind this is that when it displays the $body variable, quotes in it aren't being escaped properly by PHP when it is parsing, so add slashes to it, and then strip the slashes while the PHP is being parsed before anything is sent to the browser.)

print "Body:<br><textarea rows='15' name='body' cols='70'>stripslashes(addslashes($body))</textarea><br><br>";

composer

I can see your reasoning, but unfortunately that doesn't work.

It`s parsed literally i.e.
stripslashes(addslashes(the text up to the quote mark))

I tried $body=stripslashes(addslashes($body)) before the print statements as an experiment, but that causes a parse error, which was basically what I was expecting.

Any other ideas?

composer

Having looked at this code `til my head hurts, and decided that as far as I was concerned there was nothing wrong with it, I tried this application from anoth pc with a later version browser... and still the same.

composer

Headache over - fixed it.

else if(isset($_POST['edit'])) // if edit is pressed
{
$title=$_POST['title'];
$query="SELECT * FROM CMS_articles WHERE title='$title'";
$result=mysql_query($query);
$row=mysql_fetch_array($result);
mysql_close();

   if(!$row)
         {
           print "<br><br><font color='red'>No such entry</font>";

    }
else //if entry exists

$title=mysql_result($result,$i,"title");
$shortdescription=mysql_result($result,$i,"shortdescription");
$body=mysql_result($result,$i,"body");
?>
<form action="edit.php" method="post">
<input type="hidden" name="id" value="<? echo $id; ?>">
<b>Title:</b> <input type="text" name="title" style="background:#EEDD82" value="<? echo $title; ?>"><br>
<b>Extract:</b><br><textarea rows="3"  cols="50" style="background:#EEDD82" name="shortdescription"><? echo $shortdescription; ?></textarea><br><br>
<b>Body:</b><br><textarea rows="15" cols="70" style="background:#EEDD82" name="body"><? echo $body; ?></textarea><br>
<input type="submit" name="editnow" value="post updated article">
</form>
<?

  }

Thanks for trying to help TheDefender - appreciated

TheDefender

I see what you did to fix it, but that doesn't explain why your original problem was occuring to begin with... I wish I could find my code I had the problem with a while ago to see how it was resolved then... If I ever come across it, I will let you know...

composer

I just don't know why the first code didn't work - it seemed perfectly legitimate to pass the variable between pages... never mind, it's working now.

If you do come across that solution, I'd like to see it for future reference.

All the best 😉