Extra \ symbols added to text from my textarea.

[qiqinuinaifen128]

Hi Pro,

I have a question

i have an textarea for user to key in and a button for user to save what they key in into the textarea.

if i key in '"\ in to textarea
and i press the button save the file, the file is not shown '"\, it shows \'\"\\,
Why the file was added in this symbol \ inside my file? This will not happen if i didn't key in these three symbols.

Below is my phpcode and html code.

phpcode

<?PHP
   // Check for user data.
  if ( $_POST['FileContent'] ) {
     // Create a unique-ish filename.
    $FileName = "testing.php";
     // Create and open the file.
    $FileHandle = fopen ( $FileName, 'w' );
     // Write the data.
    fwrite ( $FileHandle, $_POST['FileContent'] );
     // Close the file.
    fclose ( $FileHandle );
 
     // Set file header information.
    header ( 'Content-Type: text/html' );
    header ( 'Content-Description: File Transfer' );
    header ( 'Content-Disposition: attachment; filename="' . basename($FileName) . '"' );
    header ( 'Content-Length: ' . filesize($FileName) );
 
     // Push file to client.
    readfile($FileName);
 
     // Delete file.
    unlink($FileName);
 
    exit();
  }
?>  
 

html code

<form action="" method="post"> 
<textarea name="FileContent"></textarea> <input type="submit">
 </form>
 

I would appreciate if any one can solve this from me.

[Markus]

You have magic_quotes turned on.

[qiqinuinaifen128]

Thank you for your prompt.

I try to add in below code in to my php. But the result same.

set_magic_quotes_runtime(false);
 

Can you give me advice?

[TheServant]

You can try use stripslashes() which removes "\" characters. Just try it and see if that works. If it does then your set_magic_quotes_runtime(false); is not working. Also just so everyone knows, magic_quotes_runtime() has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 6.0.0. Relying on this feature is highly discouraged.
I am not sure if there is a replacement.

[Markus]

@TheServant
Hopefully not; It's an inconvenience.

[Atli]

Hi.

Note that magic_quotes_runtime is not used for incoming request data, like POST data and cookies. Request data is escaped based on the value of magic_quotes_gpc.

This can not be changed on a per-file bases, because once your PHP code is executed, the request data will already have been fetched and processed.

The solution is to use the get_magic_quotes_gpc with the stripslashes function, like so:

function getPost($name) {
  if(get_magic_quotes_gpc()) {
    return stripslashes($_POST[$name]);
  }
  else {
    return $_POST[$name];
  }
}
 
$myField = getPost('myField');
 

Or simply clean the entire array at the top of the page:

if(get_magic_quotes_gpc()) {
    function stripArray(&$arr) {
        foreach($arr as &$_elem) {
            if(is_array($_elem)) {
                stripArray($_elem);
            }
            else {
                $_elem = stripslashes($_elem);
            }
        }
    }
    stripArray($_POST);
}

The best solution, however, is to simply turn the magic_quotes_gpc directive off in your php.ini configuration file.

[qiqinuinaifen128]

Thank you for you all kindly reply. You all are amazing.
I use below code to solve my problem.

<?php 
// Check for user data, if its not empty do this... 
if ( !empty( $_POST['FileContent'] ) ) 
{ 
        // stripslash the user input 
        $string = stripslashes( $_POST["FileContent"] ); 
        // Create a unique-ish filename. 
        $FileName = "Sitemaps.php"; 
        // Create and open the file. 
        $FileHandle = fopen ( $FileName, 'w' ); 
        // Write the data. 
        fwrite ( $FileHandle, $string ); 
        // Close the file. 
        fclose ( $FileHandle ); 
        // Set file header information. 
        header ( 'Content-Type: text/html' ); 
        header ( 'Content-Description: File Transfer' ); 
        header ( 'Content-Disposition: attachment; filename="' . basename( $FileName ) . '"' ); 
        header ( 'Content-Length: ' . filesize( $FileName ) ); 
        // Push file to client. 
        readfile( $FileName ); 
        // Delete file. 
        unlink( $FileName ); 
 
        exit(); 
} 
 
?> 
 

[qiqinuinaifen128]

@Atli
Your code is interesting . If i want to use your code. How can i combine your code? Can you show me?
Thank you in advance

[Atli]

@qiqinuinaifen128
Sure.

If you want to check each field separately, you could put a function, like the one in my first example, at the top of the page.
Then, rather then doing:

$string = stripslashes( $_POST["FileContent"] );

You would do:

$string = getPost('FileContent');

Or, if you would like to check each field automatically before you use them, you could simply put something like the IF statement in my second example at the top of your page.
Then you could get the fields directly from the $_POST array.

$string = $_POST['FileContent'];

Validating user input is by far the most important thing to do when developing a website, so most developers end up using a variant of either of these techniques. They can be easily modified to do additional validation.

I recommend you take a look at the Security chapter in the manual.
Specifically the parts about User Submitted Data and SQL Injection.
Once you get a handle on those two topics, you will be safe against most of the security threats out there.

[qiqinuinaifen128]

Thank you for you help and info. You all are fabulous.