Escape quotes in php

Anon

I am new to php and I have some problem dealing with quotes in strings.

I am trying to I pull out some data from an access database table, the string stored
in "Authors" field is
David Peng<>s \"home\" is here

Here is code I have:
$temp=odbc_result( $cur, "Authors");//$cur is the result of the database query
echo $temp;

and I got the result
David Peng<>s \"home\" is here

The result is exactly the same as the string I stored in database, the backslash used to escape quotes still exist.

But when I echo the same string:
echo "David Peng<>s \"home\" is here"
I get the result David Peng<>s "home" is here

And the backslash before the double quotes do not show up in the result.

I am wondering Why the backslash before the double quotes exist when
I use echo $temp? But when I echo the string directly the backslash disappear?

Can anybody help?

David

crislewis

I'm guessing but I suspect the data in the database is probably double escaped so it is actually stored as

David Peng<>s \\"home\\" is here

Which will be what is in $temp.

Check the length of temp and if necessary echo out each individual character with a <br> tag to be sure you know where the extra escapes are coming from.

Cheers,

Cris

Anon

Thanks Cris,

I tried to disable magic_quotes_gpc and
magic_quotes_runtime, and I use str_replace
to replace all single quotes with a back slash. When I pull out data from the
access database, I simply use str_replace
to replace all back slash with single quotes.It works.

But I ran into another problem. Because I need to display those string in a text field,

Suppose I pull out a database field named
author, and I process the string with above metioned method, I get a string with both
single quotes and double quotes.
Here is the string I have
David "Jessica" 'Gary'
and it is stored in $author

and I I used the following code to
display the value of author
<input type="text" name="author" value='<?php echo $author ?>>

Only David displayed in textfield, all text
after the double did not display, if I
use a single quotes to wrap the string, then
the content after single quotes won't show up?

Any suggestion?

Thanks,

David

crislewis

Firstly, I think you should rethink your data storage strategy. Why do you need quotes in your text in the first place and can you do without them.

The reason you are having this new problem will be clear to you if you view the html produced (using view source in the browser). The data is likely to be displayed as it is in the $author field but the browser will follow html rules and terminate the value displayed by the first quotes of any kind.

If you still want to display the text as it is in the variable (i.e. with quotes in tact) you need to escape them again. addslashes()?

Cheers,

Cris

Anon

Thank you very much, Cris

One more question. How can I get the user
information? I was trying to use
$ip = getenv ("REMOTE_ADDR") to get the
ip address of a user. Then I set a cookie
setcookie($ip,"$cookievalue") and I use
this cookie value to identify a user.
Could you suggest any better way to do that?

David

crislewis

Not a good idea. Most users come through ISPs who dynamically assign IP addresses as sessions are created. Therefore, one user may have many ip addresses over time.

You should either use some form of simple authentication which the user can supply a username or generate a Md5 random number and use this for the cookie id. Md5 is commnly used to create MIME mail boundaries and is pretty reliable at providing unique ids.

use something like:

$new_id = md5(uniqid(time()));

This will create a random 32 character a/n string which is virtually guaranteed to be unique.

Cheers,

Cris

Anon

Does that mean I have to store user's
information in server so next time when the web server receives http request, it will check the id stored in users browser and check it against the information stored in server to identify user?

Thanx,

David

Anon

Weren\'t you doing this anyway? How did you resolve the IP address to a user as opposed to a machine or one time internet connection?

However you were doing it before just substitute the new unique id for the ip address.

However, it makes a lot of sense to store user data in your database which will make authentication much easier when you chose to implement it. Also, how will you handle users with more than one machine? Or more than one access point? Or multiple users using the same pc, or proxy server?

What you were doing before will only identify a machine - not a user. Using the unique ID will help get over the limitations of using an IP address for this purpose.

I guess you really need to think about how important it is for you to really know whos on the other end. . . .

Cheers,

Cris