Stripslahes with functions

[consultantlmu]

Hi there,
I got a problem since a while, which I thought easy, but it's not.
If I remember well, our admin panel worked fine before the server moving. Windows to Unix.
Now, I tried to put a lot of time the function "stripslashes" in php pages ( only on admin panel ), but it does not work.
It appears that the text in contained into a variable, which is foreached into an other page, and then registered into the SQL database.

<?
openForm($processFile, $_REQUEST["action"], $id, $titre);
showStdText("Nom francophone", "pro_nom_fr", "", 255, $record);
showStdText("Nom anglophone", "pro_nom_en", "", 255, $record);
showHtmlEdit("Description francophone", "pro_description_fr",$record);
showHtmlEdit("Description anglophone", "pro_description_en",$record);
showStdNumber("Prix r&eacute;gulier",  "pro_prix", "", 11 ,$record);
showStdNumber("Prix promo",  "pro_prix_promo", "", 11 ,$record);
showDateToday("Expiration promo", "pro_promo_exp", $record);
showStdNumber("Ordre", "pro_ordre", "", 11, $record);
showStdText("Lien Boutique", "pro_boutique", "", 255, $record);
showHidden("pro_groupe_FK", $_REQUEST["grp_id"] ,$record);
closeForm();
include("incs/footerSubForm.php");
?>

Each time we need to insert a new product, we need to write things like that: The new 24\" inch from L\"appeul etc....
Else, mysql returns an error.
If you need other code from files, ask me
Thanks for your help.

[bradgrafelman]

I'm not sure what you're asking, since the code you posted doesn't use stripslashes() or do any type of DB interaction at all.

When working with DB's, however, you shouldn't have to use addslashes() or stripslashes() unless magic_quotes_gpc is enabled. When inserting data into a MySQL DB, you should sanitize it using [man]mysql_real_escape_string/man (or an equivalent function in whatever library you're using).

If incoming data already has a backslash in it before you've even done anything to it, then your host likely has magic_quotes_gpc enabled. You should do everything you can to disable this directive, be it via a custom php.ini file or through .htaccess if your host supports it. Otherwise, you could do something like this:

function stripslashes_deep($value) {
  if(is_array($value)) {
      foreach($value as $k => $v) {
          $return[$k] = $this->stripslashes_deep($v);
      }
  } elseif(isset($value)) {
      $return = stripslashes($value);
  }
  return $return;
}

if(get_magic_quotes_gpc()) {
  $_GET = stripslashes_deep($_GET);
  $_POST = stripslashes_deep($_POST);
  $_COOKIE = stripslashes_deep($_COOKIE);
}