tags:

views:

32

answers:

2

hi, my hosting server has magic_quotes on . so when i use parse_str, it also add slashes to it. so data gets stored as \\'name .. how do i prevent this.?

+2  A: 

Use PHP's stripslashes function. http://php.net/manual/en/function.stripslashes.php

I would also consider turning of magic_quotes on the server. if you can't do that then I would recommend switching hosts

Lizard
yeah i used stripslashes to take care of those extra slashes .
pradeep
+2  A: 
// Turn off magic_quotes_runtime
if (get_magic_quotes_runtime())
    set_magic_quotes_runtime(0);

// Strip slashes from GET/POST/COOKIE (if magic_quotes_gpc is enabled)
if (get_magic_quotes_gpc())
{
    function stripslashes_array($array)
    {
        return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
    }

    $_GET = stripslashes_array($_GET);
    $_POST = stripslashes_array($_POST);
    $_COOKIE = stripslashes_array($_COOKIE);
}
vertazzar
@vertazzar - This is a work around for the problem.should i do this every time . or i just need to write code,thinking host will have magic quotes off
pradeep
example, you put this code into config.php and it will strip slashes automatically from get,post, cookie.config.php can contain : e.g. your db connection details etc.. so my point is - that you just need to write the code, nothing special.
vertazzar
@vertazzar - cant we disable magic quotes in whole project(other then php.ini configuration)? does putting set_magic_quotes_runtime(0); at beginning of my page load take care of it?
pradeep
but when i see http://php.net/manual/en/function.set-magic-quotes-runtime.php it says its DEPRECATED
pradeep
that "magic_quotes_runtime" checks if webserver has it, so on new php versions its DEPRECATED.As for disabling get_magic_quotes_gpc - you could, but some discussions say that its not recommended disabling it, so anyways feel free to use the code i provided, i use it and it works like charm!
vertazzar
@vertazzar - okie.say i use the code if (get_magic_quotes_runtime()) set_magic_quotes_runtime(0); at the very beginning of my page. will this not supress magic quotes. do i still need to use the rest of codes stripslashes_array..no need rite?
pradeep
if you've turned off the quotes, you dont need stripslashes_array. but be sure to use mysql_real_escape_string on data when you insert into database to prevent SQL injection attacks. http://en.wikipedia.org/wiki/SQL_injection
vertazzar
yeah i do that for sure. cannot take risk there :)
pradeep