New User Needs Help - UPDATE not working with apostrophes

spunk999

Hello everyone - I have been referencing this forum for a long time for help with my code and I decided to register today after being super-stumped with this snipet of code that works generally, but if the value "tip" from the database has a slashed apostrophe, it is not working. The echo tags were there to verify the values of all the variables, and with fields with apostrophes, everything matched up. I did not get the die error, so the script apparently thinks it did the update? But it didn't. Again, it works for all the non-slash-apostrophe'd entries - any ideas? Thanks again!

while ($row = mysql_fetch_array($result))
{
   $tip = $row["tip"];
   $rate = $row["rate"];

   if (stripslashes($tip) == $tip2) {
	if ($vote2 == "yes") {
		$newrate = $rate + 1;
	}
	if ($vote2 == "no") {
		$newrate = $rate - 1;
	}
	$tip2 = addslashes($tip2);
	echo $tip2;
	echo "<br>";
	echo $newrate;
	echo "<br>";
	$update = "UPDATE content SET rate='$newrate' WHERE tip='$tip2'";
	mysql_query($update) or die('There was a problem with your vote, please contact the administrator.');
   }
}

laserlight

Set magic_quotes_gpc to Off in php.ini and restart the server.
Stop using stripslashes() and addslashes(), but use [man]mysql_real_escape_string/man on incoming data that is used in an SQL statement (for the old MySQL API, at least).

spunk999

Thanks for your help, laserlight ... I do not have access to the server. This site is currently hosted at GoDaddy - is there a way to do it without having to reset the server? Also with mysql_real_escape_string(), I read about it, but I am still a little confused - does that put the slashes in, or take them out? And I would apply this command to the code coming out of the database, as well as coming from POST?

rincewind456

You can use [man]set_magic_quotes_runtime/man to turn magic quotes off.

You use [man]mysql_real_escape_string/man on data input not retrieval (as laserlight said).

bradgrafelman

You could also check (via phpinfo()) if PHP was installed as an Apache Module; if so, you could use a .htaccess file in the root of your site:

php_flag magic_quotes_gpc Off
php_flag magic_quotes_runtime Off

spunk999 wrote:
as well as coming from POST?

Though it has already been explained when the [man]mysql_real_escape_string/man function should be used, I also wanted to note that the $POST array isn't the only place where user-supplied data comes from; you also have to sanitize anything coming from $GET, $COOKIE, $FILES, $REQUEST (obviously), and even some items of $SERVER.