[RESOLVED] Addslashes + MSSQL

[obrienkev]

Hi all,

How do I perform the below query properly?
I tried addslashes but no difference. Error is \\'Brien'

// perform query
$query = "INSERT INTO training_notes(note, date_entered, entered_by, email) ".
			 	 "VALUES('$note', {fn NOW()}, '$name', '$email')";

Echoed:

INSERT INTO training_notes(note, date_entered, entered_by, email) VALUES('this is a test', {fn NOW()}, 'Kevin O\\'Brien', 'kevin.o\\'[e-mail]')

[MarkR]

Firstly, disable magic_quotes_gpc and magic_quotes_runtime (and magic_quotes_sybase).

Then, use the proper escaping method for mssql, which is to double up all your quotes (Write a function to do it using one of the standard replacement functions).

Never use addslashes for anything, it isn't helpful.

Mark

[obrienkev]

I have tried the below but not working. Why is this? How do I call the function?

$name = $_POST['name'];

// format for db
function addslashes_mssql($name){
   if (is_array($name)) {
       foreach($name AS $id => $value) {
           $name[$id] = addslashes_mssql($value);
       }
   } else {
       $name = str_replace("'", "''", $name);   

   }

   return $name;
}

[Chambrln]

$note = addslashes_mssql($_POST['note']);

// perform query
$query = "INSERT INTO training_notes(note, date_entered, entered_by, email) ".
"VALUES('$note', {fn NOW()}, '$name', '$email')";

[obrienkev]

Using addslashes_mssql() doesn't seem to work - gives a blank page so syntax not right?

// declare variables
$email = $_POST['email'];
$note = $_POST['note'];
$submit = $_POST['submit'];

// Format for DB
$note = addslashes_mssql($note);
$email = addslashes_mssql($email);

// perform query
$query = "INSERT INTO training_notes(note, date_entered, entered_by, email) ".
                  "VALUES('$note', {fn NOW()}, '$name', '$email')";
echo $query;
$result = mssql_query($query) or die('Insert Query Error');

[MarkR]

Please explain "gives a blank page so syntax not right"?

Your development server should probably have display_errors enabled, or you should have an error handler which does something sensible.

Moreover, you should have error logs you can consult.

I can't imagine how you can reasonably develop PHP without having at least one of these things enabled. I have a fancy error handler which dumps stack traces etc, and logs them as well (In our production environments, users are never shown the error details, just a generic error).

Mark

[obrienkev]

Works...thanks

// Format surname for DB
function addslashes_mssql($surname){
    if (is_array($surname)) {
       foreach($surname AS $id => $value) {
           $surname[$id] = addslashes_mssql($value);
       }
    } else {
       $surname = str_replace("'", "''", $surname);   

    }

return $surname;
}

// Call Function
$surname = addslashes_mssql($surname);