[RESOLVED] Single and double quotes in form submission

RobertSmith

Hi,
I have a form and php mailer, all well except that I get \' when I type ". I solved this by enabling magic_quotes sybase in the php.ini (something bad, I believe) I could get rid of \' but now I have " appearing in places where I should have ' (apostrophe / single quotes)

How do I solve this issue
Thanks for any help

mdinnocenzo

post some of the code that is giving you the error

variables are expaned when you use ' instead of "

i had the same exact problem, but i would have to see it in context to tell you how to fix it

Dino

laserlight

RobertSmith wrote:
I have a form and php mailer, all well except that I get \' when I type ". I solved this by enabling magic_quotes sybase in the php.ini (something bad, I believe) I could get rid of \' but now I have " appearing in places where I should have ' (apostrophe / single quotes)

I suggest that you turn off magic_quotes_gpc, magic_quotes_runtime and magic_quotes_sybase.

Check the PHP code to see if it uses stripslashes(). If so, remove the use of stripslashes(). Check the PHP code to see if it uses addslashes() to escape string input to be used in SQL statements. If so, replace those uses of addslashes() with an appropriate escaping mechanism, e.g., prepared statements or say, mysql_real_escape_string().

Read the PHP manual on PHP and HTML and check if the code is missing anything in that area.

mdinnocenzo wrote:
variables are expaned when you use ' instead of "

Actually, variable expansion/interpolation happens with variables embedded in double quoted strings, not single quoted strings.

RobertSmith

Thanks laserlight and mdinnocenzo for your inputs.
As laserlight told, I know its better to switch of Magic_quotes. Laserlight, my mailer uses addslashes().

My data is not posted to a database. It's been sent by e-mail and saved to a csv file on server.

Here is the code in question

// Receiving variables
@$container_unit = addslashes($_POST['container_unit']);

//Sending Email
. "Container Unit: $container_unit\n"

laserlight

In that case, simply remove the addslashes() entirely. If you are sending HTML emails, do what is prescribed in the PHP manual entry that I linked to. Otherwise, send the text as-is.

RobertSmith

laserlight, excellent! That did the trick. Thank you very much.
You are the best.