[RESOLVED] Quotation Marks in Form Fields

Dang

To start, I am VERY new to php and have my made my first website with form fields and am having a bit of a problem.

I have several form fields where a dimension is entered (2' 7") and when the form is completed the data is sent by email to me. The data comes out like: 4\\\\' 3\\\

I have tried to use stripslashes() (maybe not correctly?) and addslashes() (maybe not correctly. Stripslashes() worked on my laptop but not when I uploaded to web server.

Here is some of the code (not sure if more info is needed):

<input id= "lfheight" type= "text" name= "lfrontheight" size= "5" maxlength= "7" 
value = "<?php if(isset($_POST['lfrontheight'])) echo $_POST['lfrontheight']; ?>" >

I used stripslashes after the echo...stripslashes(echo $_POST['lfrontheight']); ?>">

Again not sure if I applied it correctly but it did seem to work on my laptop (have easyphp1 installed). I know that this has something to do with magicquotes but not sure what to do from there.

Any help would be great.

Thank you

bradgrafelman

Dang wrote:
know that this has something to do with magicquotes but not sure what to do from there.

Sounds like magic_quotes is enabled. The first step you should is to disable magic_quotes on all servers - development, production, etc. etc.

After you disable magic_quotes, you should be able to echo the POST value and it will be returned exactly as it was entered. Since you're echo'ing this value inside of a value in an HTML element, you may want to run the contents through [man]htmlspecialchars/man (or simply [man]addslashes/man) so that you don't break the element.

Dang

I checked on my webhost and Magic Quotes GPC is enabled. I don't think there is a way to have the host turn it off, is there a way around this?

Thank you

bradgrafelman

Try using an .htaccess file that looks like this:

php_flag magic_quotes_gpc Off
php_flag magic_quotes_runtime Off

Dang

Here's how new I am...

I made a new notepad document and called it ".htaccess " and I got an error message about get a message teling me I have to name the file (because there is not name before the period). What to do?

I assume I then put that file in the same directory as the problem php file?

Again thank you for you patience and your help.

bradgrafelman

Dang wrote:
Here's how new I am...

Actually, it's not only your self-proclaimed newness - you're not waging war with PHP itself, but now you're facing off against Mr. Bill Gates.

Microsoft Windows, with all of its bells, whistles, and doodads, doesn't recognize that a file can have an extension but no name (e.g. '.htaccess') much to the amusement of the Unix world. In order to solve this, you need to trick Windows into renaming the file:

When I originally create .htaccess files on Windows, i'll give it a name such as "htaccess.txt" and fill it out accordingly.
Now you need to open a command prompt window (Start -> Run -> cmd).
Next, navigate to the place where the file is stored using the cd command. By default, the command prompt will open to the user directory (e.g. c:\documents and settings<username>[/i]). If you stored the file on your desktop, you simply need to issue the command cd desktop.
Now it's time to rename that file - issue the command rename test.htaccess .htaccess and you're done! You now have a ".htacces" file in Windows.

Dang wrote:
I assume I then put that file in the same directory as the problem php file?

I would recommend placing the .htaccess file in the root of your website. This way, it'll apply the PHP settings to all PHP scripts within your website.

Dang

I did what you said and put the lines in the .htaccess file and the renaming went fine just as you said (thank you). When I put file in the root directory as you said, it seems to lock my out of the site when I go to visit it after. (those two lines are the only two lines in the file, not sure if other information needs to be in there as well)

I get the following error:

Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.
Please contact the server administrator, webadmin@kundenserver.de and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 500 Internal Server Error error was encountered while trying to use an ErrorDocument to handle the request.

bradgrafelman

Sounds like your host isn't using the ISAPI filter but instead the CGI binary PHP parsing engine.

I would contact them about turning off magic_quotes.

Dang

I will give them a call.

One last question nagging me. If magic quotes is on wouldn't it make it so I wouldn't have this problem (make it so I can use quotation marks in my form fields)?

Thanks again for taking the time to help me.

Weedpacket

Not really; you'll only end up with the problem of quotes being magically added when you don't want them.

Besides, PHP's developers have decided the whole magic_quotes thing was a mistake; it's going away in PHP6, so it wouldn't help to become attached to them.

Dang

Works!

Just thought I'd let all know how it got resolved.
My webhost has Magic Quotes gpc set to on (which was causing my problem). They let my pui in my own php.ini file (into each directory where needed to override their settings.

This will most likely solve many problems for me as I move forward.

Thank you for all your help!