username stripslashes

grudz

Hi,

I have a signup page to make people view restricted content on my site. When they sign up they chose their own username.

On the next page, where the info is gathered and put into my database or tells the user they forgot a field, I also have put the value of the username to $_POST, so it shows them what they had originaly put.

The problem is that if they put "jimmy'o" as their username, when they go to the second page (where i gather the info), it will show "jimmy\'o" as well as in my database.

P.S. here is my code on the gathering page of the password


$signupusername=trim($_POST['signupusername']);
$signuppassword=trim($_POST['signuppassword']);
$confirm=trim($_POST['confirm']);
$name=trim($_POST['name']);
$email=trim($_POST['email']);
$address1=trim($_POST['address1']);
$address2=trim($_POST['address2']);
$state=trim($_POST['state']);
$other=trim($_POST['other']);
$zip=trim(strtoupper($_POST['zip']));
$signupusername=addslashes($signupusername);
$signuppassword=addslashes($signuppassword);

devinemke

The problem is that if they put "jimmy'o" as their username, when they go to the second page (where i gather the info), it will show "jimmy'o" as well as in my database.

huh? i don't quite understand the problem. when a user enters a username that includes a single quote what is going wrong? it appears that you are using addslashes() so it should be inserted into your db fine (unless you have other SQL syntax problems).

grudz

its two-fold,

in my database, it's written jimmy\'o
let's say the user forgets a field, the next page is going to have the values of all the textboxes that the user first put (e.g. the value of the username should be "jimmy'o" but it's "jimmy\'o"....the same as the database...

devinemke

Originally posted by grudz
- in my database, it's written jimmy\'o

it's actually in the database like that? with the slash? is that right? it sounds like you may have double addslahes() somewhere before your INSERT.

grudz

not that i can see......this is my insert


$signup = mysql_query("INSERT INTO signup (username, password, FullName, email, address1, address2, province_state, otherprovince_state, zip_postalcode, date) VALUES('$signupusername', '$signuppassword', '$name', '$email', '$address1', '$address2', '$state', '$other', '$zip', now())") or die (mysql_error()); 
print 'Thank you for filling out the form, please proceed by clicking here';

i did a "find on page" for addslash and i got only the 2 for username and password

devinemke

it sounds like you have magic_quotes ON in your php.ini. if this is the case, you don't need to addslashes(). if you do, you will be double slashing.

grudz

k..ill take it out and see what it does..

grudz

your right...it doesnt give me any \ in my database, but the value of the textbox has a \ ........im kind of in a bind, either one or the other doesnt work...

devinemke

let's back up a sec. if you have magic_quotes ON (which i gather you do) then your form data is automatically run thru addslashes() when submitted. if you wish to display the data to the user you will want to stripslashes first. just remember than you need to add them back before you do your INSERT.

make sense?

grudz

wow....i would've never thought of that....php is so flexible, just too much sometimes, because you gotta think that it could even be a possibility...

thank you it works great