slashes going inside database values

[manjushree]

Hello

My server has magic_quotes on and my code had add_slashes which I have removed. Now values get added in database properly. But there is a small problem. When filling up the form, if javascript is disabled and there is an error validating the form inputs(i.e. if any input is empty or wrong), any form input having the ' or " become /' or /" and remains as it is. Now when the form is finally submitted it goes with the /' or /" instead of simply ' or " and gets stored in the database in the same way which is what I don't want. What is it that I am doing wrong or missing??

[Dan Grossman]

Easy solution. Disable magic_quotes and properly escape (mysql_real_escape_string) the input yourself before putting it into a query.

[manjushree]

I have done that. But disabling magic_quotes gives me an error in another form on my site. Also I do not have access to change the setitngs. Isn't there a way to correct this problem keeping magic_quotes on??

Thnks

[Stormrider]

Run this code on the pages you want to 'disable' magic quotes, while keeping it on for the site/server as a whole:

if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
 $_GET    = array_map('stripslashes', $_GET);
 $_POST   = array_map('stripslashes', $_POST);
 $_COOKIE = array_map('stripslashes', $_COOKIE);
}//if 

I have this code in my init.php file which is run on every page load anyway, then code with the assumption that magic quotes is off. This will keep your code forwards compatible for when magic quotes is removed from php.

[manjushree]

Isn't there a better way, I mean calling the init.php with the if function on all pages?? For 15-20 pages it is fine but when you have code running in hundreds of pages it is not feasible.

Thnks

[Raju Gautam]

Create a page or place the code in the database connection page/file which you include all the times but should be included on top of the page.

[AnthonySterling]

Isn't there a better way, I mean calling the init.php with the if function on all pages?? For 15-20 pages it is fine but when you have code running in hundreds of pages it is not feasible.

Thnks

Host dependent, you could create a new php.ini or .htaccess on your server to disable magic_quotes.

[Stormrider]

Isn't there a better way, I mean calling the init.php with the if function on all pages?? For 15-20 pages it is fine but when you have code running in hundreds of pages it is not feasible.

Thnks

The majority of web applications will have this kind of init / bootstrap file, so it shouldn't be a problem just inserting it in there. If not, you can also automatically include files at the top of every script with php_auto_prepend_file or something, a setting in httpd.conf/.htaccess