[RESOLVED] Posting apostrophes

netfrugal

I escape the apostrophes using mysql_real_escape_string() function when inserting data to my db.

But I also pass data to a payment gateway. When I look inside my db I can see names like O'Donnell. But when I go inside my gateway I see the name O\'Donnell.

Am I not passing the data correctly, or are they not accepting the data correctly?

any thoughts?

bradgrafelman

Is magic_quotes_gpc enabled?

netfrugal

I just noticed they are Off. Should I have them on?

laserlight

Leave them off. If your database is displaying the names correctly, then chances are you are doing it correctly. After all, it just means that the database engine has correctly treated those apostrophes as escaped.

netfrugal

I noticed this just below the magic_quotes:

; Use Sybase-style magic quotes (escape ' with '' instead of \').
magic_quotes_sybase = Off

What is the difference between this and the magic_quotes?

laserlight

What is the difference between this and the magic_quotes?

Magic Quotes.

netfrugal

thanks! It's a bit more clear now.

So now, when I log into my gateway's interface and see O\'donnell, does the fault lie with the payment gateway for not escaping the apostrophe? Or is it mine when passing the last name?

I want to say it's theirs, of course, because I pass the last name with the same variable I use to insert into my database. And it appears just fine on my end.

laserlight

So now, when I log into my gateway's interface and see O\'donnell, does the fault lie with the payment gateway for not escaping the apostrophe? Or is it mine when passing the last name?

Does your payment gateway require input to be in a particular format? If it does not require escaping using mysql_real_escape_string() (perhaps because on its own side it performs such escaping), then it is your fault that you included it.

netfrugal

Here's what I do

I passed a variable like this to the gateway:

$lastname = "O\'Donnell";

When I logged into the gateway interface I see that it shows: O'Donnell.
which is what I want.

Now, I create a form that posts O'Donnell to this variable:

$lastname = $_POST['lastname'];

That causes my db to not accept the insert. So I try addslashes:

$lastname = addslashes($_POST['lastname']);

And this inserts just fine to my database. But in the gateway interface I see: O\'Donnell

Then I try

$lastname = mysql_real_escape_string($_POST['lastname']);

I get the same results.

Am I missing anything? I am passing the lastname via curl, if this helps.

laserlight

Use mysql_real_escape_string() for data going to the database(). Leave it as is for your gateway interface. It starts out as the same piece of data, but it ends up in two different locations, so treat each location differently.

netfrugal

You were right. that was a simple remedy, but I guess I needed to hear it from an outside source. :rolleyes: