PHP Help - extra code generated

[qiqinuinaifen12]

Hi,

I have a question

i have an textarea for user to key in and a button for user to save what they key in into the textarea.

if i key in '"[/COLOR] in to textarea
and i press the button save the file, the file is not shown '"[/COLOR], it shows \'\"\,
Why the file was added in this symbol [/COLOR] inside my file? This will not happen if i didn't key in these three symbols

Below is my php code and html code.

phpcode

<?PHP
   // Check for user data.
  if ( $_POST['FileContent'] ) {
     // Create a unique-ish filename.
    $FileName = "sitemaps.php";
     // Create and open the file.
    $FileHandle = fopen ( $FileName, 'w' );
     // Write the data.
    fwrite ( $FileHandle, $_POST['FileContent'] );
     // Close the file.
    fclose ( $FileHandle );

 // Set file header information.
header ( 'Content-Type: text/html' );
header ( 'Content-Description: File Transfer' );
header("Content-Disposition: attachment; filename=\"".basename($filename)."\";"); 
 header ( 'Content-Disposition: attachment; filename="' . basename($FileName) . '"' );
    header ( 'Content-Length: ' . filesize($FileName) );

 // Push file to client.
readfile($FileName);

 // Delete file.
unlink($FileName);

exit();
  }
?>  

html code

<form action="" method="post">
<textarea name="FileContent"></textarea>
<input type="submit">
</form> 

.

I would appreciate if any one can solve this from me.

[djjjozsi]

if the magic quotes has enabled in your apache settings,
lets use stripslashes in your code.You can check this settings with this function.

    if(get_magic_quotes_gpc()) {
        $string=stripslashes($_POST["FileContent"]);
    }

[qiqinuinaifen12]

Thank you for your prompt reply.

I am a newbie. Should i just add the code you give me in to my php?
or add below code?

set_magic_quotes_runtime(false);

[djjjozsi]

use this code in this case,

 $string=stripslashes($_POST["FileContent"]); 

If you don't know how to set this property, read more about it here:
http://www.askapache.com/php/custom-phpini-tips-and-tricks.html

If you need to know if this has enabled, use the get_magic_quotes_gpc() function to get this setting..
like this:

<?php
function strips( $string ) {
    if(get_magic_quotes_gpc()) {
        return stripslashes($string);
    } else {
        return $string;
    }
}
?>

[qiqinuinaifen12]

Can you show me where should i add below code?

$string=stripslashes($_POST["FileContent"]);

I try to add below code, but it's not work

<?PHP
$string=stripslashes($_POST["FileContent"]); 
   // Check for user data.
  if ( $_POST['FileContent'] ) {
     // Create a unique-ish filename.
    $FileName = "FormToEmail.php";
     // Create and open the file.
    $FileHandle = fopen ( $FileName, 'w' );
     // Write the data.
   fwrite ( $FileHandle, $_POST['FileContent'] );

 // Close the file.
fclose ( $FileHandle );

 // Set file header information.
header ( 'Content-Type: text/html' );
header ( 'Content-Description: File Transfer' );
header ( 'Content-Disposition: attachment; filename="' . basename($FileName) . '"' );
header ( 'Content-Length: ' . filesize($FileName) );

 // Push file to client.
readfile($FileName);

 // Delete file.
unlink($FileName);

exit();
  }
?>  

[djjjozsi]

if you create a new variable, use it in the fwrite command.

Better way if you check the user input with empty()

<?php
// Check for user data, if its not empty do this...
if ( !empty( $_POST['FileContent'] ) )
{
		// stripslash the user input
		$string = stripslashes( $_POST["FileContent"] );
		// Create a unique-ish filename.
		$FileName = "FormToEmail.php";
		// Create and open the file.
		$FileHandle = fopen ( $FileName, 'w' );
		// Write the data.
		fwrite ( $FileHandle, $string );
		// Close the file.
		fclose ( $FileHandle );
		// Set file header information.
		header ( 'Content-Type: text/html' );
		header ( 'Content-Description: File Transfer' );
		header ( 'Content-Disposition: attachment; filename="' . basename( $FileName ) . '"' );
		header ( 'Content-Length: ' . filesize( $FileName ) );
		// Push file to client.
		readfile( $FileName );
		// Delete file.
		unlink( $FileName );

	exit();
}

?>

[bradgrafelman]

And note that you should also be able to disable magic_quotes_gpc for your entire website; hosts usually allow you to do this by either providing your own php.ini in a certain location or by using .htaccess (if using Apache).