DB help

fxpepper

I show a last name entering into database ('users' table) like this:
O\'Brian

I found the line code which inserts this:

$this->_db->prepare('INSERT INTO users (email,first,last,dept,optin) VALUES (?,?,?,?,?)');

how would i fix it so it doesn't include this backwards slash? The name is printing on another document like this so it's a problem...

thanks

fxpepper

I found where this was output and changed the info to this:

$my_test = '';

if(get_magic_quotes_gpc()) {
	$my_test = stripslashes("$order[last]");
} else {
	$my_test = "$order[last]";
}	

$string = strtoupper("$order[first]" . " " . $my_test);

so I think that will work unless anyone has any advice on better coding for this...

but i still did have a question - in the DB it still saves with a slash - is that okay?

Weedpacket

I'd say either (a) you're manually escaping text that the database driver is going to escape anyway when it fills in the SQL statement, or (b) you've got magic quotes turned on.

fxpepper

Weedpacket;10997805 wrote:
I'd say either (a) you're manually escaping text that the database driver is going to escape anyway when it fills in the SQL statement, or (b) you've got magic quotes turned on.

yes, I found out that magic quotes is on. So I just used striplashes function to correct the output...

thanks

bradgrafelman

fxpepper;10997806 wrote:
So I just used striplashes function to correct the output...

To correct the problem, you need to get magic_quotes disabled ASAP.

What you've done is simply implement a workaround in one location of one of your PHP scripts. Any other PHP scripts are still being affected by magic_quotes.

EDIT:

fxpepper wrote:
in the DB it still saves with a slash - is that okay?

Long answer: You tell us - is it okay for the DB to store data that isn't actually in the form that you want or need?

Short answer: No.

fxpepper

bradgrafelman;10997810 wrote:
To correct the problem, you need to get magic_quotes disabled ASAP.

Not sure how do that exactly and not sure if there are any ramifications of changing it so I will talk to someone about doing that. It sounds like it would be for the better though..

bradgrafelman;10997810 wrote:
Long answer: You tell us - is it okay for the DB to store data that isn't actually in the form that you want or need?

I wouldn't think so but it was set up this way to begin with so didn't know for sure...

thank you

NogDog

If you are not in a position where you can alter/override the PHP configuration settings, you can use this kludge:

<?php
/**
 * Undo the damage of magic_quotes_gpc if in effect
 * @return bool
 */
function fix_magic_quotes()
{
   if (get_magic_quotes_gpc()) {
      $func = create_function(
         '&$val, $key',
         'if(!is_numeric($val)) {$val = stripslashes($val);}'
      );
      array_walk_recursive($_GET, $func);
      array_walk_recursive($_POST, $func);
      array_walk_recursive($_COOKIE, $func);
   }
   return true;
}

// USAGE
fix_magic_quotes();

bradgrafelman

fxpepper;10997815 wrote:
Not sure how do that exactly

See the manual page [man]configuration.changes[/man] to see different ways to alter the PHP configuration. Note that most hosts usually allow you to do this either via .htaccess or your own user-supplied php.ini file (which follows the same syntax as the usual php.ini file).

fxpepper;10997815 wrote:
not sure if there are any ramifications of changing it

Well one ramification would be that your data doesn't get double-escaped (resulting in literal backslashes appearing in your DB data). 😉 Another, of course, would be that scripts which implicitly depended on this function to be the only layer of protection would then lose that. (But they'd have to be really old and/or written really poorly in order for that to be true.)

fxpepper

NogDog;10997817 wrote:
If you are not in a position where you can alter/override the PHP configuration settings, you can use this kludge:
I am not exactly in position to change so i am using the snippet you provided for now.  I will ask the guy in charge about it when he gets in.

thanks so much everyone!

Weedpacket

Make a note that magic_quotes is gone as of PHP 5.4, so if there is anything relying on it then it has to be fixed or never upgrade PHP again.

cretaceous

..and thanks Nogdog - create_function is a new one for me
(thus showing that reading random threads can be most educational)

Weedpacket

cretaceous wrote:
..and thanks Nogdog - create_function is a new one for me

Though largely outdated since PHP 5.3, when the function could be declared and stored in a variable directly:

function fix_magic_quotes()
{
	if (get_magic_quotes_gpc()) {
		$func = function(&$val, $key) {
			if(!is_numeric($val))
				$val = stripslashes($val);
		};
		array_walk_recursive($_GET, $func);
		array_walk_recursive($_POST, $func);
		array_walk_recursive($_COOKIE, $func);
	}
	return true;
}