Preventing the Slashing in posts.

[Sugartonic]

I used a basic php guestbook tutorial to make a guestbook and it works fine. But with a user posts messages contained the following " ' it creates a slash with it

example of what user would post.

Braxton's Cheese

It would appear on the view page as

Braxton\'s Cheese

This is the script that the form uses to process the information

[PHP]<?php
// SQL database Variables

$hostname='';
$user=''; //'user name for MySQL database';
$pass=''; //'Password for database';
$dbase=''; //'database name';
$connection = mysql_connect(" $hostname" , "$user" , "$pass") or die ("Cannot connect to database");
$db = mysql_select_db ($dbase , $connection) or die ("Cannot select database");

// for register globals off
$name = mysql_escape_st ring($_POST["name"]);
$email = mysql_escape_st ring($_POST["email"]);
$sitename = mysql_escape_st ring($_POST["sitename"]);
$siteurl = mysql_escape_st ring($_POST["siteurl"]);
$comments = mysql_escape_st ring(strip_tags ($_POST["comments"]));
$ip = $_SERVER["REMOTE_ADD R"];

// This is form.php
$q="INSERT into guestbook (id,name,email, sitename,siteur l,date,ip,comme nts)
VALUES ('','$name','$e mail','$sitenam e','$siteurl',n ow(),'$ip','$co mments')";

$result= mysql_query($q) or die
("Could not execute query : $q." . mysql_error());

if ($result)
{
echo "Thank you, $name. Your entry has been recorded.";
}

?>
<meta http-equiv="refresh" content="3;URL= view-book.php">
<?php include("footer .php"); ?>[/PHP]

[Banfa]

Check the value of $_POST["comments"], if you have magic quotes (I think) on then PHP may have already added the slash and the mysql_escape_st ring will be adding at again like so:

User inputs

Braxton's Cheese

PHP changes it to

Braxton\'s Cheese

mysql_escape_st ring changes it to

Braxton\\\'s Cheese

And then you end up with a slash in the string in the database.