PHP/Mysql/special characters problem

[Mosher]

Hi all,

I have an issue with php and/or mysql. I have a php form that writes "items"
to a mysql database, including a description of the item. On the mysql
server, "magic_quotes_g pc" is ON.

I am testing it now by putting special characters in the description field,
this is what I am entering:

O'Leary "special edition"

Now, this item data always gets written to the db just fine and shows up in
the db as entered. Seems correct and working just fine up to this point.

My problem is with my "edit item" page. This page allows users to update
items, including the mentioned "descriptio n" field. But when the data is
called back up from the db to display in the "edit item" page and the
description contains double quotes, the description is cut off, and only
shows:

O'Leary

Here is the code (snippet of the important stuff and numbered) on the "edit
item" page:

1. $result = mysql_query("se lect * from inven where product =
'$product'");
2. $row = mysql_fetch_arr ay($result);
3. echo "Descriptio n is: $row[description]";
4. echo "<table width=80% border=1 cellpadding=4 cellspacing=0>" ;
5. ?>
6. <tr><td>Produ ct #:</td><td><input type=text name=product value="<?echo
$row[product]?>"></td></tr>
7. <tr><td>Descrip tion:</td><td><input type=text name=descriptio n
value="<?echo $row[description]?>" size=50></td></tr>
8.
9. <?
10. echo "</table>";
11. echo "<br><br><i nput type=submit name=Update value=Update>";
12. ?>

The important line of code here is line 6, where the value of description
should show. The real value of description that is in the database should be
showing up here, but it is cut off if it contains double quotes. Note also
that the full value (double quotes and all) of description can be seen in
the echo statement at line 3. I'm stumped.

To sum up this problem, data appears to get written to the db just fine. The
"edit item" page is brought up, but the description - if it contains special
characters, is cut off, apparently where there are double quotes. If I go
ahead and update the item, the new value in the db is now cut off and not
what I want.

Any ideas? Thanks in advance.

Mosher

[Pedro Graca]

Mosher wrote:

6. <tr><td>Produ ct #:</td><td><input type=text name=product value="<?echo
$row[product]?>"></td></tr> The important line of code here is line 6, where the value of description
should show. The real value of description that is in the database should be
showing up here, but it is cut off if it contains double quotes. Note also
that the full value (double quotes and all) of description can be seen in
the echo statement at line 3. I'm stumped.

The quotes are there :)
view the source!

This is a HTML problem: you're trying to output HTML similar to
<input value="John "Q" Smith">
and the browser doesn't know how to interpret it

Try html_entities()
<form ...>
<!-- ... -->

<input value="<?php echo html_entites($r ow['product'], ENT_QUOTES); ?>"/>

<!-- ... -->
</form>
http://www.php.net/html_entites
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--

[Pedro Graca]

I (Pedro Graca) mis-wrote:

http://www.php.net/html_entites

Sorry, that should have been
http://www.php.net/html_entities
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--

[Mosher]

Pedro - thanks so much! That helped and I can now view the full double
quoted data.

However, when I try to "update" the information into the db, the
single/double quoted stuff doesn't get written to the db. I tried an
html_entity_dec ode function, but that only writes single quotes to the db,
not double. Here is my decode code that I put in the same code that you
commented on previously:

<input type=hidden name=descriptio n value="<?echo
html_entity_dec ode($row[description])?>">

It's my understanding that we need to decode the html_entities data before
writing to db, right? Any ideas how I could get the whole string, single and
double quotes included, written into the db?

Thanks again,

Mosher

"Pedro Graca" <he****@hotpop. com> wrote in message
news:bs******** ****@ID-203069.news.uni-berlin.de...

Mosher wrote:

6. <tr><td>Produ ct #:</td><td><input type=text name=product value="<?echo $row[product]?>"></td></tr>

The important line of code here is line 6, where the value of description should show. The real value of description that is in the database should be showing up here, but it is cut off if it contains double quotes. Note also that the full value (double quotes and all) of description can be seen in the echo statement at line 3. I'm stumped.

The quotes are there :)
view the source!

This is a HTML problem: you're trying to output HTML similar to
<input value="John "Q" Smith">
and the browser doesn't know how to interpret it

Try html_entities()
<form ...>
<!-- ... -->

<input value="<?php echo html_entites($r ow['product'], ENT_QUOTES); ?>"/>

<!-- ... -->
</form>
http://www.php.net/html_entites
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--

[Agelmar]

Mosher wrote:

Pedro - thanks so much! That helped and I can now view the full double
quoted data.

However, when I try to "update" the information into the db, the
single/double quoted stuff doesn't get written to the db. I tried an
html_entity_dec ode function, but that only writes single quotes to
the db, not double. Here is my decode code that I put in the same
code that you commented on previously:

<input type=hidden name=descriptio n value="<?echo
html_entity_dec ode($row[description])?>">

It's my understanding that we need to decode the html_entities data
before writing to db, right? Any ideas how I could get the whole
string, single and double quotes included, written into the db?

Thanks again,

Mosher

NO... you do not need to decode anything before flushing it to the db. All
you need to do is shove it in (being sure to call something like
mysql_escape_st ring first, obviously)

[Pedro Graca]

Mosher wrote:

It's my understanding that we need to decode the html_entities data before
writing to db, right? Any ideas how I could get the whole string, single and
double quotes included, written into the db?

From DB to browser
htmlentities()

From browser to DB
mysql_escape_st ring()

But beware of magic quotes (I don't have them on)
--
--= my mail box only accepts =--
--= Content-Type: text/plain =--
--= Size below 10001 bytes =--

[Agelmar]

Pedro Graca wrote:

Mosher wrote:

It's my understanding that we need to decode the html_entities data
before writing to db, right? Any ideas how I could get the whole
string, single and double quotes included, written into the db?

From DB to browser
htmlentities()

From browser to DB
mysql_escape_st ring()

But beware of magic quotes (I don't have them on)

you will likely want to do something like
$string = get_magic_quote s_gpc() ?
mysql_escape_st ring(stripslash es($string)) : mysql_escape_st ring($string);

[Mosher]

Guys,

I tried to use the mysql_escape_st ring($descripti on), but it didn't work.
When I enter this string from the description field:

O'Leary "special"

....it sends this to the db:

O\\\'Leary \\

....and because magic quotes in on, this is what actually got written to the
db:

O\'Leary \

Also, any information that comes after the description field has now
dissapeared. I am in "special character" hell! Help!!! Remember that
magic_quotes_gp c is 'ON'.

Thanks,

Mosher

"Agelmar" <if**********@c omcast.net> wrote in message
news:bt******** ****@ID-30799.news.uni-berlin.de...

Pedro Graca wrote:

Mosher wrote:

It's my understanding that we need to decode the html_entities data
before writing to db, right? Any ideas how I could get the whole
string, single and double quotes included, written into the db?

From DB to browser
htmlentities()

From browser to DB
mysql_escape_st ring()

But beware of magic quotes (I don't have them on)

you will likely want to do something like
$string = get_magic_quote s_gpc() ?
mysql_escape_st ring(stripslash es($string)) : mysql_escape_st ring($string);

[Ken Robinson]

"Mosher" <mo***********@ yahoo.com> wrote in
news:fY******** ************@co mcast.com (in part):

Guys,

I tried to use the mysql_escape_st ring($descripti on), but it didn't
work. When I enter this string from the description field:

O'Leary "special"

...it sends this to the db:

I've come in late, but you may want to try:

From the form to DB: urlencode(strip slashes($string ))
From the DB to the display: urldecode($db_s tring)

Ken Robinson

[Mosher]

Hi Ken,

Thanks for this, but it did not work. Once again (prior to your code), the
data gets written to the db just fine, quotes and all. But when I call it
back up to edit it, that is where the problem is. First, the field data:

O'Leary "special"

....only displayed O'Leary when called back up. I then was able to get around
that by the following line of code:

<input type=text name=descriptio n value="<? echo
htmlentities($r ow[description])?>">

This did display the full data above with quotes, etc. But when I look in
the actual source code of the webpage being displayed, it shows:

O'Leary&quot;sp ecial&quot;

....in the field and when I try to write to db, it only writes:

O'Leary

Any other ideas?

Thanks,

Mosher

"Ken Robinson" <se**********@r bnsn.com> wrote in message
news:45******** *************** *******@news.te ranews.com...

"Mosher" <mo***********@ yahoo.com> wrote in
news:fY******** ************@co mcast.com (in part):

Guys,

I tried to use the mysql_escape_st ring($descripti on), but it didn't
work. When I enter this string from the description field:

O'Leary "special"

...it sends this to the db:

I've come in late, but you may want to try:

From the form to DB: urlencode(strip slashes($string ))
From the DB to the display: urldecode($db_s tring)

Ken Robinson