htmlentities adds slashes - why?

[Randell D.]

Folks,
I'm using Apache/1.3.28 (SuSE 7.1, kernal 2.4) with PHP/4.3.2. I have the
following code to help cleanse form data.

function cleanData($sour ceData, &$cleanData)
{ foreach($myData as $fieldName=>$fi eldValue)
{ if(strlen($fiel dValue)>0)
{ $cleanData[$fieldName]=htmlentities(t rim($fieldValue )); }
else
{ $cleanData[$fieldName]=""; }
}

return;
}

cleanData($_POS T, $formData);


I tested the code and found a \ was placed before double quotes
automatically - I have had to use stripslashes to clean the offending
slashes but I was wondering why they appeared the first place. A view
source of my html code, via my client browser produced the following (until
I used stripslashes which removed the slashes).

\"here\&qu ot;

What is the recommended action here? Is it something I need switch off in
php.ini or is it safer for me just to continue and use stripslashes as part
of my function?

Thanks
randelld

[uws]

Re: htmlentities adds slashes - why?

I <U3KYa.671744$r o6.14005252@new s2.calgary.shaw .ca>, Randell D. skrev:[color=blue]
> I tested the code and found a \ was placed before double quotes
> automatically - I have had to use stripslashes to clean the offending
> slashes but I was wondering why they appeared the first place.[/color]

Because " is used as a string delimiter in html tag attributes,
htmlentities() adds a backslash to make sure those double quotes are not
treated as such.

dag maar weer tot de volgende keer meneer, Wouter

--
:wq mail uws@xs4all.nl

so much we don't know :: even our own true face -- after forever

[Andy Hassall]

Re: htmlentities adds slashes - why?

On Fri, 8 Aug 2003 11:58:05 +0200, uws <uws@xs4all.inv alid> wrote:
[color=blue]
>I <U3KYa.671744$r o6.14005252@new s2.calgary.shaw .ca>, Randell D. skrev:[color=green]
>> I tested the code and found a \ was placed before double quotes
>> automatically - I have had to use stripslashes to clean the offending
>> slashes but I was wondering why they appeared the first place.[/color]
>
>Because " is used as a string delimiter in html tag attributes,
>htmlentities () adds a backslash to make sure those double quotes are not
>treated as such.[/color]

No... If it were to escape a double quote in HTML, it would output &quot;

Backslashes do not escape in HTML. This is not caused by htmlentities, or if
it is, it's a bug in a specific version...

--
Andy Hassall (andy@andyh.co. uk) icq(5747695) (http://www.andyh.co.uk)
Space: disk usage analysis tool (http://www.andyhsoftware.co.uk/space)

[Andy Hassall]

Re: htmlentities adds slashes - why?

On Fri, 08 Aug 2003 09:29:24 GMT, "Randell D."
<you.can.email. me.at.randelld@ yahoo.com> wrote:
[color=blue]
>I'm using Apache/1.3.28 (SuSE 7.1, kernal 2.4) with PHP/4.3.2. I have the
>following code to help cleanse form data.
>
>function cleanData($sour ceData, &$cleanData)
>{ foreach($myData as $fieldName=>$fi eldValue)
> { if(strlen($fiel dValue)>0)
> { $cleanData[$fieldName]=htmlentities(t rim($fieldValue )); }
> else
> { $cleanData[$fieldName]=""; }
> }
>
> return;
>}
>
>cleanData($_PO ST, $formData);
>
>I tested the code and found a \ was placed before double quotes
>automaticall y - I have had to use stripslashes to clean the offending
>slashes but I was wondering why they appeared the first place. A view
>source of my html code, via my client browser produced the following (until
>I used stripslashes which removed the slashes).
>
>\&quot;here\&q uot;[/color]

This indicates that your original string was:

\"here\"

_before_ it got to htmlentities.

Do you have magic_quotes_gp c turned on? If this is on, all incoming
POST/GET/etc. data is escaped á la addslashes().
[color=blue]
>What is the recommended action here? Is it something I need switch off in
>php.ini or is it safer for me just to continue and use stripslashes as part
>of my function?[/color]

Turn off magic_quotes_gp c and use addslashes() where appropriate (i.e. not in
this case).

--
Andy Hassall (andy@andyh.co. uk) icq(5747695) (http://www.andyh.co.uk)
Space: disk usage analysis tool (http://www.andyhsoftware.co.uk/space)