[Resolved] Add Slashes is destorying my messages

[Sayian]

In my PM system , alot of people are complaining that my insert message function is destroying their messages like this

example message:
Well basically what it is , It\'s just someone who would be a moderator of ALL forums .. a \

a wasnt supposed to be the end of the message , but php put a \ and then cut everything else off , why?

Here is my function , what is wrong with this?

function insert_private_message($user_id, $subject, $message, $authorid){
global $tb_pms;

$subject = ereg_replace("<([^>]+)>", "", $subject);
$comment = ereg_replace("<([^>]+)>", "", $comment);

$sql = "
        insert into $tb_pms (
            id,
            user_id,
            subject,
            message,
            author_id,
            author_ip,
            pm_status,
        readornot
        ) values (
            '',
            '$user_id',
            '$subject',
            '$message',
            '$authorid',
            '$_SERVER[REMOTE_ADDR]',
            'inbox',
        'N'
        )
";
$query = mysql_query($sql) or die(mysql_error());
}

i dont see anything that would be causing that , do you?

[m_tt]

What is your 'message' field type/length?

Have you checked the database to make sure it's a problem with input and not output?

Also I see in the function you use $comment but in the query you use $message.... whats this?

[Sayian]

Hi Matt ,

My message field type , is " Text "

Does this need to be changed?

Im pretty sure it's a problem with input , b/c when i goto sql , i see the broken message.

[m_tt]

There really is nothing that would cause it to cut off the message and if it was a problem with foreign characters your query should error out..

have you tried adding addslashes() to the message? (the title says thats the cause but I dont see it anywhere 😉)

'Text' field should be fine as well as long as there is no length value set

[Sayian]

Sorry about the subject title , i got confused with another function i was looking at. Very stressed right now , this is causing a major problem.

Is their anyway i can just remove when people type '

isnt ' causing the problem?

[m_tt]

Since you use a text field type you should be fine with using addslashes..

'" . addslashes($message) . "',

They should appear normal in the database and no need to use stripslashes for output.

If anything, this will guarentee the message is input safely and completely into the database. I would recommend using it on the subject field as well

[Drakla]

look into [man]get_magic_quotes_gpc[/man] - if it's on then you can just input data straight into the database from $POST, $GET, $_REQUEST or whatever you're using. Otherwise you have to use mysql_escape_string or addslashes before you insert the data.

When displaying data back out to HTML you have to use htmlentities on it, so that things like > and < and quotes don't cock things up. If you output within double quotes you don't need to modify htmlentities, if you put it in single quotes then also use the ENT_QUOTES option.

If you have a look at your source for the page you might see that the data is in there but the browser isn't showing it because quotes have been closed by those in the post.

[Sayian]

Ok thanks for the help guy's ..

Ive looked intp the Manual and found the syntax for addslashes

Does this look correct now?

Also , ive ran a test with some word's <-- like that.

and everything came out ok

Does this look proper?

function insert_private_message($user_id, $subject, $message, $authorid){
global $tb_pms;

$subject = ereg_replace("<([^>]+)>", "", $subject);
$comment = ereg_replace("<([^>]+)>", "", $comment);

$subject = addslashes($subject);
$comment = addslashes($comment);

$sql = "
        insert into $tb_pms (
            id,
            user_id,
            subject,
            message,
            author_id,
            author_ip,
            pm_status,
        readornot
        ) values (
            '',
            '$user_id',
            '$subject',
            '$message',
            '$authorid',
            '$_SERVER[REMOTE_ADDR]',
            'inbox',
        'N'
        )
";
$query = mysql_query($sql) or die(mysql_error());
}

[m_tt]

Looks good... i'm still confused how you are magically getting $comment to be $message 😛

[Sayian]

it's amazing at the smallest things i miss!

No wonder the shit wouldnt work

thanks matt , lol

[Drakla]

Have you tested it with putting a < in it yet? Unless you use htmlspecialchars when outputting you're still in trouble