PHP Curl adds '\' to apostrophe character sending to ASP page

Question

I have a 3rd party server which has a classic ASP page which takes in form data. From my web page I have a PHP script which sends fields to the ASP page using curl. Everything works fine except if a user includes an apostrophe character to the text. In the back end it is received as "\'". What is even odder is that it only does this from my hosted website. When I test locally it works fine.

Here is the PHP snippet which sends the data:

$datatopost = array (); 
foreach($_POST as $key => $data) {
    $datatopost[$key] = $data;
}

$ch = curl_init("http://my.server.com/validate.asp");
curl_setopt($ch, CURLOPT_POST,1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); 
curl_setopt($ch, CURLOPT_POSTFIELDS, $datatopost);
$result =  curl_exec($ch);

Answer 1

You probably need to disable Magic Quotes in that particular server: http://php.net/manual/en/security.magicquotes.php

Furthermore, you could add this code to the top of your scripts (better yet, in a library you include in each page) so no matter the enviroment, you'll always get the magic quotes reversed:

<?php
if (get_magic_quotes_gpc()) {
    function stripslashes_deep($value)
    {
        $value = is_array($value) ?
                    array_map('stripslashes_deep', $value) :
                    stripslashes($value);

        return $value;
    }

    $_POST = array_map('stripslashes_deep', $_POST);
    $_GET = array_map('stripslashes_deep', $_GET);
    $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
    $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
}
?>

Taken from http://php.net/manual/en/security.magicquotes.disabling.php

Answer 2

Make sure you have magic quotes disabled. Seeing how your data comes from $_POST, that is the most likely culprit.

Answer 3

Use PHP's filter_input() to get at the POST variables. This will bypass magic_quotes if they're enabled and will encourage you to validate or sanitize your input, as appropriate.

This approach will require you to know the names of the POST variables ahead of time, but that's a good thing. Here's how it might look:

$expected_keys = array(
    'foo',
    'bar',
    // etc.
);

$datatopost = array();

foreach ($expected_keys as $expected_key) {
    $value = filter_input(INPUT_POST, $expected_key, <filter>, [<options>]);

    if ($value !== FALSE && !is_null($value)) {
        $datatopost[$expected_key] = $value;
    }
}

// CURL code here