[RESOLVED] mysql_real_escape slashes stored?

snyde

Hi. Thanks for reading.

I think I've been chasing a ghost for a bit.

I have been paranoid that mysql_real_escape_string has not been working because I can't actually see the slashes in the Db.

Clarify this for me please.

Are slashes added to escape characters using mysql_real_escape_string() in an INSERT or UPDATE query actually stored in the Db with the data? Or are they simply used by mysql in the process of storing the data?

If they are not stored then I won't need to strip them in php5 with magic_quotes off. correct?

Thanks for your time.

laserlight

Are slashes added to escape characters using mysql_real_escape_string() in an INSERT or UPDATE query actually stored in the Db with the data?

No.

Or are they simply used by mysql in the process of storing the data?

Yes.

As an analogy, consider the output of:

echo "\"Hello world!\"";

Which do you expect?
a)

"Hello world!"

\"Hello world!\"

greensweater

MySQL returns strings unescaped. If you wanted to re-update the record with the resulting string, you would have to mysql_real_escape_string again.

snyde

Got it. Thanks!

laserlight

You're welcome 🙂
Remember to mark this thread as resolved (if it is) using the thread tools.

NogDog

greensweater wrote:
MySQL returns strings unescaped. If you wanted to re-update the record with the resulting string, you would have to mysql_real_escape_string again.

This is a bit misleading: the slashes never get stored in the database, thus there is nothing for MySQL to strip out when it "returns" a string. The back-slashes added by mysql_real_escape_string() are only relevant within the SQL statement used to communicate with the database. LaserLight's analogy to escaped quotes in a PHP echo command is very applicable: just as in a PHP echo statement the escaping only has "meaning" within the PHP source code of the echo statement and are not part of the actual output to the client, the backslashes from mysql_real_escape_string() only have "meaning" within the SQL source code in which they are used, but are not part of the actual data that ultimately gets "output" to the database.

snyde

I get it completely now, but as I was implementing M_R_E_S from ADD/STRIP slashes, I was pulling my hair out and for some stupid reason, it didn't occur to me until much time was waisted that it worked that way.

Thanks for your help. Maybe I'm dense, but what I find hard to believe is that it was so difficult to get clarification on the matter from already published sources. (including the manual, which I do read!)

Hope this post helps someone else.

Thanks Again!

NogDog

There has also been a lot of confusion thrown into this matter by PHP's magic_quotes_gpc setting. When it is turned on, if its effects are not eliminated by doing a stripslashes() to form form data before applying mysql_real_escape_string(), then many of the characters which the mysql_real_escape_string() function escapes are already escaped with backslashes, so those backslashes end up being escaped and then do make it into the database. :rolleyes: Thus it generally considered a best practice now to not have magic_quotes_gpc enabled, as it just muddies the water and makes assumptions which may not be correct for every situation.