[RESOLVED] Normal behavior w/ slashes?

La_Parka

Before anything is inserted into my site's DB, I run addslashes() on it. When the function is used, data in the DB looks exactly like it did when it was submitted. For example, if a user enters O'Reilly in a form, it will appear as O'Reilly in the database (when viewed in phpmyadmin, at least.) This seems to negate the need for stripslashes() when displaying text from the database, as there are no slashes in the string.

When addslashes is run, shouldn't the text in the database read O\'Reilly? Or is my site experiencing PHP's normal behavior with slashes?

ETA: FWIW, magic_quotes_gpc is on.

laserlight

Before anything is inserted into my site's DB, I run addslashes() on it.

Do not use addslashes(). Keep magic_quotes_gpc to Off, and use the appropriate escaping function for your database interface, e.g. [man]mysql_real_escape_string/man in PHP's old mysql interface.

Better yet, use prepared statements with the PDO interface.

This seems to negate the need for stripslashes() when displaying text from the database, as there are no slashes in the string.

That is correct, there is no need to do stripslashes() on text retrieved from the database.

La_Parka

I replaced addslashes() with mysql_real_escape_string() and disabled magic_quotes_gpc.

Now, when O'Reilly is inserted into the DB via a form, it still returns O'Reilly when queried. However, the code echo mysql_real_escape_string("O'Reilly"); reads as O\'Reilly. Should this be expected?

laserlight

However, the code echo mysql_real_escape_string("O'Reilly"); reads as O\'Reilly. Should this be expected?

Yes, since you are then viewing the code as it is when entering the database. The database engine handles the escaped character, hence it is not stored in escaped form, so upon retrieval from the database, it is not in escaped form.

Take for example the escaped backslash in PHP.

echo "\\";

Do you expect to see one or two backslashes in the output? You entered two, but only one is printed, since the two backslashes are actually one escaped backslash.