stripslashes vs quotes

[Sergei Riaguzov]

Hmm, I can apply stripslashes() to a string, causing it to remove slashes
near quotes (\") but how can I change this quotes to appropriate HTML
quotes like "?

[Michael Fesser]

Re: stripslashes vs quotes

..oO(Sergei Riaguzov)

>Well then I will ask a lamer question, what is the best way to deal with
>situation when you have a textarea in a form and some text in some other
>place on the page, and everything which is written in the form is send to
>the same page via POST to the same textarea which produces slashes?

Slashes are produced by magic quotes, an old and absolutely broken
concept. Thankfully it will be removed in PHP 6. But for now you have to
call get_magic_quote s_gpc() to check if MQs are enabled. If that's the
case, call stripslashes() on the POST or GET values to get the raw data.
That's what you should always work with.

Then, when printing something out to an HTML page again, run it through
htmlspecialchar s() to take care of these special chars that might break
your HTML (<, & and ").

Micha

[Michael Fesser]

Re: stripslashes vs quotes

..oO(Sergei Riaguzov)

>No it should be just text. I ended up in:
>
>htmlspecialcha rs(stripslashes ($_POST["blabla"]), ENT_QUOTES);

This might break if magic quotes are turned off! Only use stripslashes()
when necessary. See my other reply.

Micha

[Sergei Riaguzov]

Re: stripslashes vs quotes

On Tue, 24 Jul 2007 13:10:37 +0200, Michael Fesser wrote:

Slashes are produced by magic quotes, an old and absolutely broken
concept. Thankfully it will be removed in PHP 6. But for now you have to
call get_magic_quote s_gpc() to check if MQs are enabled. If that's the
case, call stripslashes() on the POST or GET values to get the raw data.
That's what you should always work with.

OK, thank you! I will use "if (get_magic_quot es_gpc())" check before
applying stripslashes() and won't apply it in case get_magic_quote s_gpc()
returns false.

[Toby A Inkster]

Re: stripslashes vs quotes

Rik wrote:

Allthough the content of a textarea isn't an attribute, so most tag-soup
HTML browsers would have no problem displaying it properly with normal
qoutes.

As will conformant HTML browsers: it's perfectly legal to include
unescaped quotes in a <textarea>.

--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.12-12mdksmp, up 33 days, 19:09.]

Parsing an HTML Table with PEAR's XML_HTTPSax3

http://tobyinkster.co.uk/blog/2007/07/20/html-table-parsing/

[Robin]

Re: stripslashes vs quotes

Sergei Riaguzov wrote:

On Tue, 24 Jul 2007 13:10:37 +0200, Michael Fesser wrote:
>

>Slashes are produced by magic quotes, an old and absolutely broken
>concept. Thankfully it will be removed in PHP 6. But for now you have to
>call get_magic_quote s_gpc() to check if MQs are enabled. If that's the
>case, call stripslashes() on the POST or GET values to get the raw data.
>That's what you should always work with.

OK, thank you! I will use "if (get_magic_quot es_gpc())" check before
applying stripslashes() and won't apply it in case get_magic_quote s_gpc()
returns false.

The ternary conditional operator comes in handy here, so your original
function call:

htmlspecialchar s(stripslashes( $_POST["blabla"]), ENT_QUOTES);

becomes

htmlspecialchar s(get_magic_quo tes_gpc()?strip slashes($_POST["blabla"]):$_POST["blabla"],ENT_QUOTES);

Robin

[Michael Fesser]

Re: stripslashes vs quotes

..oO(Robin)

>The ternary conditional operator comes in handy here, so your original
>function call:
>
>htmlspecialcha rs(stripslashes ($_POST["blabla"]), ENT_QUOTES);
>
>becomes
>
>htmlspecialcha rs(get_magic_qu otes_gpc()?stri pslashes($_POST["blabla"]):$_POST["blabla"],ENT_QUOTES);

I would rather put that into a function:

function getPostData($na me) {
if (isset($_POST[$name])) {
return get_magic_quote _gpc()
? stripslashes($_ POST[$name])
: $_POST[$name];
} else {
return NULL;
}
}

Or something like that.

Micha