ansaurus

Question

Answer 1

+2 A:

Turn off magic quotes in your PHP settings. The feature is deprecated anyway.

David Dorward 2010-10-08 11:31:53

I have checked out php.ini, it looks like magic quotes is disabled:<code>; Magic quotes;; Magic quotes for incoming GET/POST/Cookie data.magic_quotes_gpc = Off; Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc.magic_quotes_runtime = Off; Use Sybase-style magic quotes (escape ' with '' instead of \').magic_quotes_sybase = Off</code>

Riccardo 2010-10-08 13:59:46

Yea, that's the default settings in PHP5.3, because as said magic quotes are deprecated. In this case you SHOULDN'T use stripslashes on the string! stipslashes is only necessary if magic quotes are enabled and that's actually what I've posted in my anwser. If magic quotes are on, stripslashes will be used, if not they won't. If for any reason you have to port your code to a server where magic quotes are enabled and you can't or aren't allowed to disable them (i.e. cause they disturb other scripts) than my solution will still work, while the above one won't.

Tseng 2010-10-08 17:34:51

Answer 2

+1 A:

If you don't want to disable magic quotes (even though they won't be working anymore in PHP 6.0 as they were deprecated in 5.3), you can use this code

$txt = $_POST['txt'];
if(get_magic_quotes_gpc())
    $txt = stripslashes($txt);

this way stripslashes would only be enabled when your PHP module has magic quotes enabled or ignore it otherwise

Tseng 2010-10-08 12:07:59

As I wrote, stripslashes seems dangerous for some asian-encoded languages, like Japanese....

Riccardo 2010-10-08 13:41:17

ansaurus

tags:

views:

answers:

HTML Forms - removing slashes safely

related questions