$mysqli->real_escape_string() not working

[dragon52]

Hi there,

Can anyone tell me why the escape_string routines work on my PC but not on the server?

I am using object version of mysqli

PC PHP version = 5.2.9-2
Server PHP version = 5.3.2-1

if ($mysqli->set_charset("utf8")) {
}

$okName = $mysqli->real_escape_string($_POST['Name']);
$okName = htmlspecialchars(okName);

test string = (Toby is a good <>'"-/)

output on my pc = (Toby is a good &lt;&gt;\'\&quo t;-/)
output on server = (Toby is a good <>'"-/), ie unchanged

Thanks

[Luuk]

Change line 5 to:

$okName = htmlspecialchars($okName);

[dragon52]

Thanks for your reply Luuk.

I did have $okName in my program. That was a typing error in my question. Sorry.

Any other ideas? What can be the difference between the systems on my PC and the server?

[Luuk]

How are you viewing the output of your server?
If you do this in a browser, did you do a 'view source'?

[dragon52]

Thanks for your reply Luuk.

This is part of the code for a registration form. I save the user info to a mysql database. I am trying to validate the user input to eliminate potential problems such as chars "/<>'"\".

I test the code on my PC before migrating it to the server. So the code is the same in both environments.

I look at the db records created and noticed the functions have no effect on the server. I use the app "mySQL Query Browser" to look at the records on my pc and a browser to display server records. No haven't use "view source" to do that. Server is down right now. Output

db record on my pc = (Toby is a good &lt;&gt;\'\&quo t;-/)
db record on server = (Toby is a good <>'"-/), ie unchanged

thanks for your help. Ideas? Here is a bit more of my code .

    $okName = $mysqli->real_escape_string($_POST['Name']);
    $okName = htmlentities($okName);

    $sql = "INSERT INTO OnlineTbl (UserName,..) VALUES ('okName',..)";

    if (!$mysqli->query($sql)) {
        die("Error: ".$mysqli->error);
    }

[Luuk]

If you see a '<' in your browser,
Than the source might look like '&lt;'

[dragon52]

Yes, you are right.

I didn’t realise the browser would convert chars back automatically.

Thank you very much Luuk. Problem solved.

[mHealth]

Your server may have different configuration/version of mysql.