[RESOLVED] Slashes and Forms and PHP

Cynthia_Blue

Okay.. I put together a tiny little test page need ya'lls help trying to get this to work. 🙂

If anyone has time to look I'd appreciate it!

My problem is dealing with the single quote. Put in a word with a single quote and then hit the continue button. It'll take you to a second page and will display the variables as they pass, with and without stripslashes.

On the first time through it looks fine. However, when on the second page, put something else in, and hit Back. As you'll see, the apostrophe is replaced by the backslash, regardless of stripslashes. and the variable is truncated after the single quote.

Help! I have a process like this passing variables through a number of form pages until I gather all the info I need and eventually will write it to a database.

I'd looove help! Thanks!

Norman_Graham

Hi Cynthia

Is magic quotes on or off?

Norm

rincewind456

If your storing variables for later entry to a database why are you processing it before you're ready to insert to the DB, are you using sessions?

Also if you look at the source of the form here

<input type='hidden' name='field2' value='o\'reilly'>
                                            ^

you'll see that the form is breaking down here because you're using single quotes around your attribute values, try the form with double quotes.

Cynthia_Blue

I'll post the code from the two pages too, to show the php and how I'm passing the variables:

fieldtest1.php:

<? 
$field1 = ($field1 == "") ? "" : $field1; 
echo "<br>field1: $field1 ";
echo "<br>field2: $field2 ";
echo "<br>field1 stripslashes: " . stripslashes($field1);
echo "<br>field2 stripslashes: " . stripslashes($field2);
?>

<html>
<body>

<form method='post' action='fieldtest2.php' name='formname'>

<INPUT class="inputField" TYPE="text" NAME="field1" SIZE="30" MAXLENGTH="9" value="<? echo $field1; ?>">
<input type='hidden' name='field2' value='<? echo $field2 ?>'>
<input TYPE='submit' name='buttonname' value='Continue' width='20'>

</form>


</body>
</html>

fieldtest2.php:

<?
$field2 = ($field2 == "") ? "" : $field2; 
echo "<br>field1: $field1 ";
echo "<br>field2: $field2 ";
echo "<br>field1 stripslashes: " . stripslashes($field1);
echo "<br>field2 stripslashes: " . stripslashes($field2);
?>

<html>
<body>

<form method='post' action='fieldtest1.php' name='formname'>

<INPUT class="inputField" TYPE="text" NAME="field2" SIZE="30" MAXLENGTH="9" value="<? echo $field2; ?>">
<input type='hidden' name='field1' value='<? echo $field1 ?>'>
<input TYPE='submit' name='buttonname' value='Back' width='20'>

</form>


</body>
</html>

Magic Quotes is Annoyingly On. 🙂

Edit: Oops pasted same one twice. What I get for using remote admin. 🙂

Cynthia_Blue

Oh... and, the main application has about 5 pages the user has to page through to gather various information. The page 2 that displays (either page2a or page2b) is dependent upon the information entered into page 1, and so forth. That is why I'm using multiple pages with forms on each page and passing the variables through.

This is just a tiny portion to demonstrate the problem I'm having with the full app. At the end of the app I'll insert the data into a DB.

Edit... I'm not using sessions, I've heard of them but I'm not familiar with what they are or how to use them.

rincewind456

Well you can set the magic qoutes off at runtime with

set_magic_quotes_runtime(0)

By the looks of this script you also have register_globals set on!

Cynthia_Blue

Okay.. my LAN guy is going to turn magic quotes off for me and see what happens. And yes, isn't register globals always on? 😉

Cynthia_Blue

Hrm.. that was interesting. He turned it off briefly, and what happened was the first time through, the vars passed okay. But then on the second page click, the var was still TRUNCATED! But just without backslashes. So it didn't solve my problem. Ugh.

rincewind456

Try this, break the file into 3 and see if the values being passed are correct.

Cynthia_Blue

Seems to give me the same type results. I just copied and pasted your code in, didn't change anything.

http://www.utahdogs.com/vendor/fieldtest1.php

bpat1434

Well, this works for me:

fieldtest1.php

<?php
$field1 = (@$_POST['field1'] == '') ? "" : $_POST['field1']; 
?>

<html>
<body>

<?php
echo "field1: $field1 ";
echo "<br>field1 stripslashes: " . stripslashes($field1);
?>

<form method='post' action='fieldtest2.php' name='formname'>
<INPUT class="inputField" TYPE="text" NAME="field1" SIZE="30" MAXLENGTH="9" value="<?php echo stripslashes($field1); ?>">
<input TYPE='submit' name='buttonname' value='Continue' width='20'>
</form>

</body>
</html>

fieldtest2.php

<?php
$field1 = $_POST['field1'];
?>

<html>
<body>

<?php
echo "field1: $field1 ";
echo "<br>field1 stripslashes: " . stripslashes($field1);
?>

<form method='post' action='fieldtest1.php' name='formname'>
<INPUT class="inputField" TYPE="text" NAME="field1" SIZE="30" MAXLENGTH="9" value="<?php echo stripslashes($field1); ?>">
<input TYPE='submit' name='buttonname' value='Back' width='20'>
</form>

</body>
</html>

Changes:

Got rid of "field2" all together in both scripts
Line 15 Added stripslashes($field1); [Both files]

~Brett

Cynthia_Blue

Yup Mostly.. but I need to have more than 1 field name, so I'll need to keep field1 and field2. My working app has multiple fields on all pages. But ya'll started me on the solution.

The problem lies in this line:

<input type='hidden' name='field1' value='<? echo $field1 ?>'>

I originally had the value=' ' .. note the single quotes. So if there is another single quote inside the variable name, such as "duck's"... it looks at value='duck's'. And so keeps only duck, leaving everything else off.

I changed the above to look like this:

<input type='hidden' name='field1' value="<? echo stripslashes($field1) ?>">

note the double quotes for the value attribute. Also used the same syntax for the input field. And it works. 🙂

Thanks for the help!

bpat1434

Heh.. all that work for something so simple....

Oh well...

glad you got it working.

~Brett