Preventing the Slashing in posts.

[Sugartonic]

I used a basic php guestbook tutorial to make a guestbook and it works fine. But with a user posts messages contained the following " ' it creates a slash with it

example of what user would post.

Braxton's Cheese

It would appear on the view page as

Braxton\'s Cheese

This is the script that the form uses to process the information

[PHP]<?php
// SQL database Variables

$hostname='';
$user=''; //'user name for MySQL database';
$pass=''; //'Password for database';
$dbase=''; //'database name';
$connection = mysql_connect("$hostname" , "$user" , "$pass") or die ("Cannot connect to database");
$db = mysql_select_db($dbase , $connection) or die ("Cannot select database");

// for register globals off
$name = mysql_escape_string($_POST["name"]);
$email = mysql_escape_string($_POST["email"]);
$sitename = mysql_escape_string($_POST["sitename"]);
$siteurl = mysql_escape_string($_POST["siteurl"]);
$comments = mysql_escape_string(strip_tags($_POST["comments"]));
$ip = $_SERVER["REMOTE_ADDR"];

// This is form.php
$q="INSERT into guestbook (id,name,email,sitename,siteurl,date,ip,comments)
VALUES ('','$name','$email','$sitename','$siteurl',now(), '$ip','$comments')";

$result= mysql_query($q) or die
("Could not execute query : $q." . mysql_error());

if ($result)
{
echo "Thank you, $name. Your entry has been recorded.";
}

?>
<meta http-equiv="refresh" content="3;URL=view-book.php">
<?php include("footer.php"); ?>[/PHP]

[Banfa]

Check the value of $_POST["comments"], if you have magic quotes (I think) on then PHP may have already added the slash and the mysql_escape_string will be adding at again like so:

User inputs

Braxton's Cheese

PHP changes it to

Braxton\'s Cheese

mysql_escape_string changes it to

Braxton\\\'s Cheese

And then you end up with a slash in the string in the database.