Best way to get quoted text in mysql?

[JW]

It took me a lot of trial and error to get text from an HTML form into MySQL to
account for quotation marks being entered. I came up with the following. It
works fine but I was wondering if this is the best way. Here are the relevant
snippets:

1) User enters data via post.html:

<form method="POST" action="post_co nfirm.php" name="form">
<textarea NAME="comments" ROWS=4 COLS=60 onkeyup="textLi mit(comments,
800);"></TEXTAREA>
<input type="submit" name="Submit2" value="Submit" onClick="return
validate(form)" >
</form>

2) User is presented with the confirmation form post_confirm.ph p:

Strips html tags, and displays without the slashes that PHP puts in:
<?php $comments=strip slashes(strip_t ags($_POST['comments'])); ?>

Displays the user comments:
<?php echo $comments; ?>

If ok, user sends it to be posted:
<form method="POST" action="postnot ice.php">
<input type="hidden" name="comments" value="<?php echo
htmlspecialchar s($comments, ENT_QUOTES ); ?>">
</form>

3) Stuff is posted in MySQL via postnotice form:

<?php $comments=addsl ashes($_POST['comments']); ?>
Better way or OK?

TIA -

jon
--
jwayne@_myrealb ox_no_spam.com

[Jochen Daum]

Hi jwayne!

On Mon, 30 Jun 2003 16:05:12 -0400, JW <jwayne@_myreal box_no_spam.com >
wrote:

It took me a lot of trial and error to get text from an HTML form into MySQL to
account for quotation marks being entered. I came up with the following. It
works fine but I was wondering if this is the best way. Here are the relevant
snippets:

1) User enters data via post.html:

<form method="POST" action="post_co nfirm.php" name="form">
<textarea NAME="comments" ROWS=4 COLS=60 onkeyup="textLi mit(comments,
800);"></TEXTAREA>
<input type="submit" name="Submit2" value="Submit" onClick="return
validate(form) ">
</form>

2) User is presented with the confirmation form post_confirm.ph p:

Strips html tags, and displays without the slashes that PHP puts in:
<?php $comments=strip slashes(strip_t ags($_POST['comments'])); ?> You can turn of the slashes that are put in, by using the ini_set with
magic_quotes_gp c. My suggestion is to turn it off.

Displays the user comments:
<?php echo $comments; ?>

If ok, user sends it to be posted:
<form method="POST" action="postnot ice.php">
<input type="hidden" name="comments" value="<?php echo
htmlspecialcha rs($comments, ENT_QUOTES ); ?>">
</form>

3) Stuff is posted in MySQL via postnotice form:

<?php $comments=addsl ashes($_POST['comments']); ?>
Better way or OK?

You may get around the one stripslashes with my suggestion.

Hope I could help.

Jochen
--
Jochen Daum - CANS Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

[Jochen Daum]

Hi !
On Mon, 30 Jun 2003 20:18:23 -0400, JW <jwayne@_myreal box_no_spam.com >
wrote:

You may get around the one stripslashes with my suggestion.

I tried your suggestion but there is problem: when I do a mysql_query, it bombs
with _single_ quotes in the user text.

Sorry. Just remove one instance of stripslashes, not all instances of
*slashes. But your code was fine anyway. If you use shared servers,
you might not be in control of these switches anyway. Maybe have a
look at get_magic_quote s_gpc.

HTH, Jochen
--
Jochen Daum - CANS Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.
http://sourceforge.net/projects/phpdbedittk/

[Paul Liversidge]

Jochen Daum <jo*********@ca ns.co.nz> wrote in message news:<lm******* *************** **********@4ax. com>...

Better way or OK?

There is a RemoveMagicQuot es function floating around, probably on
php.net in the user comments that I've found to be very effective. You
just run it on the top of every page and it removes the magic quotes
if the server has them on or off. I've moved PHP scripts between
hosting companies and it can suddenly make a working script, not work.
A little auto-detection and dealing with it can help.