stripslashes problem (American Inch Marks = ")

[Terry]

I have a form that my wife uses to update her tennis racket website. I
modified it to allow data entry, modify, and delete. If you enter an id
number you get the matching record if there is one. The data from that
record is now displayed in the form ready to change. The second submit
of the same id updates the record.

$description=$_POST['description'];
$grip=$_POST['grip']; // Sizes are in inches (")

if ($id) {
$query="SELECT * FROM `rackets` WHERE id=$id";
// Standard stuff here

if (($id)and($id==$oldid)) { //$oldid is a hidden input field
$row[3]=$description;
$row[4]=$grip;
}

<form>
<textarea id=\"description\" name=\"description\">$row[3]</textarea>
<label>Grip Sizes </label><input type=\"text\" id=\"grip\"
name=\"grip\" maxlength=\"60\" size=\"60\" value=\"$row[4]\">
[Submit]
</form>

$query="SELECT * FROM `rackets` WHERE 1 ORDER BY id DESC";
echo "All Records in a table for review" // Displays properly

$row[3] and [4] have escape characters \

-------------------
Added $row[3]=stripslashes($description);
$row[4]=stripslashes($grip);

$description will display whatever is entered ' and "
$grip will truncate anything after the " when the record comes up for
modification.

The only difference I can see is one is a textarea, the other an input box.

Any ideas welcomed (and thanks to anyone willing to wade through all
this stuff).

--
TK
http://www.wejuggle2.com/
Still Having a Ball




..

----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet News==----
http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
----= East and West-Coast Server Farms - Total Privacy via Encryption =----

[NC]

Terry wrote:

<form>
<textarea id=\"description\" name=\"description\">$row[3]</textarea>
<label>Grip Sizes </label><input type=\"text\" id=\"grip\"
name=\"grip\" maxlength=\"60\" size=\"60\" value=\"$row[4]\">
[Submit]
</form>

$description will display whatever is entered ' and "
$grip will truncate anything after the " when the record comes up for
modification.

The only difference I can see is one is a textarea, the other an input box.

Not only that; the "value" attribute in the "grip" input is enclosed in
double quotes. So outputting a double quote inside the attribute
closes the value. You need to replace double quotes with &quot; before
outputting $row[4] (or simply run htmlspecialchars() on it before
outputting).

Cheers,
NC

[Andy Jeffries]

On Thu, 18 May 2006 10:20:17 -0500, Terry wrote:

<input type=\"text\" id=\"grip\"
name=\"grip\" maxlength=\"60\" size=\"60\" value=\"$row[4]\">

$description will display whatever is entered ' and " $grip will
truncate anything after the " when the record comes up for modification.

The answer is simple, your content contains a " and the HTML attribute
uses " to contain the value. So effectively you have this:

value="12" racket"

So the value trims after 12 and then has racket" after it.

There are two ways round this:

1) Hacky - use value='$row[4]' which will allow you to use " within the
data

2) Better - use htmlentities on the data before displaying it for editing
using ENT_QUOTES to convert quotes to HTML entities. Browsers will
display the proper character and allow editing as if it's a single
character.

Cheers,
Andy
--
Andy Jeffries MBCS CITP ZCE | gPHPEdit Lead Developer
http://www.gphpedit.org | PHP editor for Gnome 2
http://www.andyjeffries.co.uk | Personal site and photos

[Terry]

Andy Jeffries wrote:

On Thu, 18 May 2006 10:20:17 -0500, Terry wrote:

<input type=\"text\" id=\"grip\"
name=\"grip\" maxlength=\"60\" size=\"60\" value=\"$row[4]\">

$description will display whatever is entered ' and " $grip will
truncate anything after the " when the record comes up for modification.

The answer is simple, your content contains a " and the HTML attribute
uses " to contain the value. So effectively you have this:

value="12" racket"

So the value trims after 12 and then has racket" after it.

There are two ways round this:

1) Hacky - use value='$row[4]' which will allow you to use " within the
data

2) Better - use htmlentities on the data before displaying it for editing
using ENT_QUOTES to convert quotes to HTML entities. Browsers will
display the proper character and allow editing as if it's a single
character.

Thanks a Bunch. (NC too)

Used 2) - not very strong at coding - but I am rather obsessive.

--
TK
http://www.wejuggle2.com/
Still Having a Ball




..

----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet News==----
http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
----= East and West-Coast Server Farms - Total Privacy via Encryption =----

[Mladen Gogala]

On Thu, 18 May 2006 10:20:17 -0500, Terry wrote:

Any ideas welcomed (and thanks to anyone willing to wade through all
this stuff).

You have 2 choices:
1) To use preg_replace instead of stripslashes
2) In the affected fields replace " by the word "inch" and
then do "stripslashes"

--
http://www.mgogala.com