On Tue, 27 Jan 2004 12:22:23 -0500, Jerry Stuckle
<jstucklex DeleteThis @attglobal.net> wrote:
> GreyWyvern wrote:
>>
>> On 23 Jan 2004 03:12:00 GMT, Kkiely <kkiely DeleteThis @aol.comnojunk> wrote:
>>
>> > When i write a form-to-text file a "\" always appreas. Why is this?
>>
>> When POSTing a form, slashes are usually added before quote chracters
>> like
>> " and '. I don't know whether this is added by the browser sending the
>> info or the server recieving it, but they happen. Perhaps someone could
>> enlighten me on that.
>>
>> Anyway, Duende has it right if you're using PHP to handle the form
>> input.
>> Use the stripslashes() function to get rid of those nasty slashes. But
>> if
>> you're planning on putting that form input into a SQL database don't
>> forget to add them back in with addslashes() !
>>
>
> Actually, SQL doesn't use backslashes as escape characters.
You're right, it doesn't. But the queries sent by the PHP function
mysql_query() do if you use ""!

What's troubling about that is that
you'll get no error message from MySQL if a query fails because it's not
escaped properly through PHP.
I remember wondering for a long while why my INSERTs weren't working when
one of the fields I was trying to input contained a single quote '
character.
Grey
--
The technical axiom that nothing is impossible sinisterly implies the
pitfall corollory that nothing is ridiculous.
- <a style='text-decoration: underline;' href="http://www.greywyvern.com" target="_blank">http://www.greywyvern.com</a> - Orca RingMaker: PHP web ring creation and
management<!-- ~MESSAGE_AFTER~ -->
>> Stay informed about: Why does "" always appear in my forms?