Quote Marks

zzz

I thought I already fixed this but just noticed that it's still wrong.

When I submit form amy date is stored in db like this

  regular text \"double-quoted text\" \'single-quoted text\'

However when I retreive data from db and put it into form again as

stripslashes($db_data)

it cuts the quoted text off...

  regular text  'single-quoted text'

This only happens when I put text into form field. If I just echo it back it prints it correctly.

  regular text "double-quoted text" 'single-quoted text'

laserlight

Set magic_quotes_gpc to Off.
Use the appropriate escaping mechanism for your database, e.g., mysql_real_escape_string(), or better yet, prepared statements.
When retrieving from the database, use htmlspecialchars() on text to be written into HTML code.
Quote your attribute values in your HTML form controls. I typically use double quotes for this purpose since htmlspecialchars() does not translate single quotes by default.

zzz

I use a little part of Joomla and they highly recommend enabling magic_quotes_gpc. I'm afraid if I disable them I may be opening some security hole in Joomla...

What really puzzles me is that when I echo quoted text on a page it all works fine but it is cut withing text field...

NogDog

Output text to html using the [man]htmlentities/man function, with ENT_QUOTES for the optional 2nd parameter, e.g.:

<p><?php echo htmlentities($text, ENT_QUOTES); ?></p>

...or...

<input type="text" name="test" value="<?php echo htmlentities($row['test'], ENT_QUOTES); ?>">

zzz

Bingo. I've used htmlentities($row['test'], ENT_QUOTES) to output into form fields, and it worked great! However the same syntax ptinted slashes when output as a simple text, so i used stripslashes there and it took care of it.

zzz

CORRECTION. Not sure why the first time I tested everything looked great -- it kept all quoted and not quoted text and did not have any slashes, but on a second try it inserted slashes. So the final version, however convoluted it may be, is:

stripslashes(htmlentities($row['test'], ENT_QUOTES))

It works...