PHP Problem

Anon

Okay, I got the script working so it doesn't display the \ in front of the '. BUT, in my script I have a preview button, where I can preview the news before I submit it to database. Well, when I press that, the \ appears in the textbox. Below is an excerpt from the script for the preview. Does it look right?

if ($preview) {
$query = "SELECT Name from tblStaff WHERE Name='$alias'";
$result = mysql_db_query("$database", $query);
$r = mysql_fetch_array($result);
$name = $r["Name"];

$template = "template/news.tmp";
$fd = fopen($template,"r" );
$temp_contents = fread($fd, filesize($template));
fclose($fd);

if ($update_mode) {
$temp_contents = eregi_replace("Posting news to Database", "Editing news in Database", $temp_contents);
$temp_contents = eregi_replace("", "<input type=hidden name=update_mode value='yes'> <input type=hidden name=alias value='$name'>$name", $temp_contents);
$temp_contents = eregi_replace("<input type='text' name='title' maxlength='35'>", "<input type='text' name='title' maxlength='35' value=\"$title\">", $temp_contents);
$temp_contents = eregi_replace("</textarea>", "$news_post</textarea>", $temp_contents);
$temp_contents = eregi_replace("<input type='submit' name='post_news' value='Post News'>", "<input type='submit' name='fix_post' value='Update'>", $temp_contents);
}
else {
$temp_contents = eregi_replace("", "<input type=hidden name=alias value='$name'>$name", $temp_contents);
$temp_contents = eregi_replace("<input type='text' name='title' maxlength='35'>", "<input type='text' name='title' maxlength='35' value=\"$title\">", $temp_contents);
$temp_contents = eregi_replace("</textarea>", "$news_post</textarea>", $temp_contents);
}

print $temp_contents;
print "<input type=hidden name=username value='$username'>";
print "<input type=hidden name=password value='$password'>";
print "<input type=hidden name=id value='$id'>";
print "</form>";
include("preview.php3");
load_copyright();
mysql_free_result($result);
Exit;
}

toma42

It looks like crap man. First off, use stripslashes() to get rid of them...next, don't do
... value='$username'>";
becuase if username has a ' in it the input won't show the rest of the string from that point on.

Next, the Exit; at the end is processed as a string, I think. This isn't vbscript...you have to include () after functions.

Your eregi's are hard to read. Concider learning a templating scheme. I prefer phplib templates but I think a lot of people find fasttemplates easier to learn.