[RESOLVED] Problems with nl2br

Maharg105

Hi Guys,

I'm having a wee problem at the moment, with some of my code and I thought I'd check with you guys to see if there was a simple solution before I pull yet more of my hair out.

I have an element on my site that allows users to add articles to the database. Now this all works, except if the article contains quotation marks. Then all hell breaks loose.

I have tried using nl2br, htmlentities, htmlspecialchars and a combination of all three. But no matter what I do, the returned data has the quotes escaped using . After a little bit of research, I have been led to believe this might be caused by magic quotes?

This is causing me the mother of all headaches, so I thought I'd see if anyone could enlighten me.

As always, thanks for your help people,

Pikachu2000

Did you try stripslashes()?

laserlight

Yes, it might. Is magic_quotes_gpc (and related settings) turned off as it should be?

halojoy

🙂
Exactly how much hair have you left?

Yeah, you are probably very right.
This is at server/hosting where you have magic_quotes_gpc ON.
What you can see if you run [man]phpinfo/man

You can also do one simple test using

<?php
echo get_magic_quotes_gpc();  // 1=ON  0=off
?>

The easy fix is often this.
Using [man]stripslashes[/man] (remove slashes added by magic_quotes_gpc)

Say the text entered is $_POST['input']

<?php

//$_POST['input'] is 'some entered text from a form';

if (get_magic_quotes_gpc()) { //if magic is = ON
    $input = stripslashes($_POST['input']);
}else{
    $input = $_POST['input']; //magic was OFF
}

?>

Maharg105

Hi Pikachu,

Thanks for the input. I did a little more digging and found that magic quotes were still enabled for the CMS element of my site. I've since added a php.ini file that has disabled them.

I am currently using the following code to process the article;

$story= nl2br(htmlentities(($_POST['story']), ENT_QUOTES));

And then I am inserting this data straight into the database. It appears to be working perfectly. Can anyone see any problems with doing it this way? The interface is only accessible via a secure CMS, so security worries are not paramount.

Thanks, as always,

Maharg105

Hi Halojoy,

Thanks for popping in mate. As mentioned above, I finally figured out that was the problem.

Unfortunately there isn't much hair left, but hopefully I can still get a decent comb over out of it 🙂

Pikachu2000

Maharg105;10947139 wrote:
Hi Pikachu,

Thanks for the input. I did a little more digging and found that magic quotes were still enabled for the CMS element of my site. I've since added a php.ini file that has disabled them.

I am currently using the following code to process the article;
$story= nl2br(htmlentities(($_POST['story']), ENT_QUOTES));
And then I am inserting this data straight into the database. It appears to be working perfectly. Can anyone see any problems with doing it this way? The interface is only accessible via a secure CMS, so security worries are not paramount.

Thanks, as always,

Glad you got it figured out, but I'd still sanitize it prior to entry into the db. Security is always paramount, IMHO.