managing slashes with quotes somehow?!

[deuce868]

I have a text field for a title that might include both single and souble quotes. I am trying to figure out how best to deal with them. I have a clean function I got from a book that runs the values posted through the EscapeShellCmd command. In the process it seems to add a backslash to the quote. Now the odd thing is I can't seem to figure out how it seems to add a variable number of back slashes. Sometimes I seem to get 6, 2, 1, 4. I am missing something.

So I tried to manage this so that when someone edits the title it gets pulled up correctly. I made a funtion for get_title that first runs the stripslashes command to get rid of any slashes and then run addslashes to escape the quotes in there and then returns the new value to the page to be displayed. I am getting 6 \'s now. What is the correct way to deal with this? How can I allow the ' and " in the text field but make sure it does not mess with my database query and displays correctly?

Thanks a ton, this is driving me mad.

[ReviewCast]

This sounds like a bad case of magic_quotes confusion.

When I add text to the MySQL database I use this function which will only addslashes if magic_quotes_gpc is off:

function add_slashes ( $text )
    {
    if ( !get_magic_quotes_gpc() ) 
        {        
        $text = addslashes( $text );
        }
        return $text;
    } 

If I am displaying data from a form (but not the database) I use this function, which will stripslash the variable if it has automaticaly be slashed by the magic_quotes:

function strip_slashes ( $var ) 
    { 
    if ( get_magic_quotes_gpc() ) 
        {    
        $var = htmlentities ( stripslashes ( $var ) ); 
        }
    
    return $var;
    } 

HTH

Chris

[Helge]

Hi,
If you want more info about magic_quotes_gpc(), read the magic_quotes, addslashes(), and stripslashes() part of PHP and MySQL coding tips.

-Helge