Sessions/POST/single quotes issue

snidog

I have an order form that is split up over 5 steps, carrying the info from one step to the next using sessions. The order form works great, except.......

On step 3, the user is required to enter the name of his/her company. If the name has an apostrophe in it (e.g., Guido's Barber Shop), then all the session variables set on that page end up getting lost.

The crazy thing is, they don't get lost right away. When I do a print_r of my session variables on that page, they show up fine. But when you go to the next page, to complete the order, they have disappeared.

My server has magic_quotes on, and I am using stripslashes so that I don't get slashes in my forms.

Have any of you ever come across this issue? Please help me ASAP, this is urgent. Thank you so much in advance.

mtmosier

If your question is "Does an apostrophe in a variable make sessions not work?" the answer is no, apostrophes don't change anything.

For more specific help I'd suggest posting some code.

snidog

I would love to post some code. The problem is, there are at least three pages of order form involved, as well as a couple includes, etc., so I don't even know what to post. That's why I am hoping that someone here has dealt with something similar, and can maybe point me in the right direction. In the five years I have been doing PHP, I haven't experienced this before.

One thing I failed to mention, that may or may not be relevant, is that we have a custom MySQL session handling system set up. It is very basic, and I don't have any idea if it could be part of the problem, but I thought I would mention that, just in case. Thanks.

mtmosier

Sounds like a good suspect. Does your mysql session handler call mysql_real_escape_string for all values being inserted?

If you don't find anything there how about posting the mysql code, and the code of the page on which the session variables are lost.

snidog

That was it! Right after I posted about the MySQL handler, I got to thinking that the mysql_real_escape_string might be the problem. When you immediately mentioned it too, I went looking, and sure enough, I had forgotten to put that in. I added it in, and my test order worked fine. My colleague is contacting the gentleman whose actual order didn't work to try it again, but I am positive that we have fixed it and it will work. Thanks so much for your help.