User Contributed Notes
addslashes |
  |
info@bokelberg.de
11-Sep-1999 12:37 |
|
Using an oracle database addslashes
doesn`t work to escape single
quotes.
You have to double the single quote
instead. Here is an
example using
ereg_replace:
$escaped_string =
ereg_replace("'","''",$string_with_single_quotes);
|
|
|
|
flybird123@sina.com
26-Apr-2000 11:28 |
|
addslash can quote binary data from a database. Form example
$result = mysql_query("SELECT * FROM sendbuf where
flagsend = 0 ",$connin);
while ($myrow =
mysql_fetch_array($result))
{
$pic1_data =
addslashes($myrow ["pic1_data"]) ;
}
|
|
leingang@math.harvard.edu
08-Aug-2000 05:16 |
|
Not sure if this is the right place to put this, but...adding slashes will
not work to escape quotes in the VALUE field of hidden elements! Instead,
use urlencode() and urldecode().
|
|
jlp
17-Aug-2000 12:54 |
|
note that the escaping style used by addslashes depends on the
configuration variable magic_quotes_sybase-- even if magic_quotes_gpc and
magic_quotes_runtime are
disabled.
eg:
$string="foo\\bar'baz\"quux";
ini_alter("magic_quotes_sybase",0);
$string1=addslashes($string);
ini_alter("magic_quotes_sybase",1);
$string2=addslashes($string);
print("string1:
$string1
");
print("string2:
$string2
");
outputs:
string1:
foo\\bar\'baz\"quux
string2: foo\bar''baz"quux
|
|
se@brainbits.net
29-Sep-2000 01:32 |
|
The problem with the automatically added slashes is not a php4 or php
3.0.xx and higher problem. PHP automatically adds slashes when the
"magic_quotes" are enabled in the php.ini !!!
|
|
nightowl@uk2.net
12-Dec-2000 04:31 |
|
If you want to import the exported file into Access, you also need to
dubble the "'s .
I used
$write =
ereg_replace("\"","\"\"",$original_text);
|
|
spamdunk@home.com
06-Mar-2001 08:12 |
|
FYI, Quoting the single quote (') as ('') is not an Oracle stle, or a
Sybase style, or any other vendor-specific style. It is the ANSI SQL (i.e.
SQL standard) style.
Using blackslahes to escape characters is a
proprietary extension that some databases have. If you want your SQL to be
portable across databases, don't use it.
For example (on
PostgreSQL):
=> create table t (s
varchar(64));
CREATE
=> insert into t values
('one''two"three''');
INSERT 206474 1
wapkey=> select *
from t;
s
----------------
one'two"three'
(1
row)
... as expected, as per the standard.
|
|
php@NO_SPAMj-w3.com
02-Apr-2001 10:18 |
|
As mentioned, magic_quotes_gpc automatically adds slashes to POST and GET
data and these slashes don't go in the database. BUT, be careful of this.
If you have a form with an error check, make sure you strip the slashes if
your form remembers the OK fields, so the user doesn't view these
automagically added slashes.
|
|
hybrid@n0spam.pearlmagik.com
09-May-2001 05:46 |
|
Remember to slash underscores (_) and percent signs (%), too, if you're
going use the LIKE operator on the variable or you'll get some unexpected
results.
|
|
designinghelp@designinghelp.com
20-Jun-2001 10:26 |
|
On problem I had to figure out was adding slashes to a string, inserting
into mysql, adding more slashes, and inserting into a file.
To do
this on all the servers I tested it on correctly I did this:
if
(!get_magic_quotes_gpc()) {
$message =
addslashes($message);
$message = str_replace('$', '\$', $message
);
}
insert to mysql
$message =
str_replace("\\" , "\\\\", $message );
$message =
str_replace('$', '\$', $message );
insert to file
From my
testing that works completely.
|
|
glenn.hoeppner@nospam.usa.net
29-Jun-2001 06:33 |
|
A single quote will be escaped as \' which MySQL takes and enters in the
SQL standard form ''. Be aware of that when using addslashes() and
stripslashes().
|
|
geggert@web.de
17-Jul-2001 05:59 |
|
_JAVA-SCRIPT_ has no precast possibility to get rid off added slashes (as
far as I know).
I wrote this function to fix this little
deficit:
function stripslashes (arbstrg) {
if (typeof
arbstrg != 'string') return arbstrg;
if (arbstrg.length > 1)
{
for(qqq=arbstrg.length-2; qqq>=0; qqq--) {
if (arbstrg.substring(qqq,qqq+1) == "\\") {
hlpchr = arbstrg.substring(qqq+1,qqq+2);
if
((hlpchr == "\'") || (hlpchr == "\"") || (hlpchr
== "\\")) {
helpstrg =
arbstrg.substring(qqq+1,arbstrg.length);
arbstrg
= arbstrg.substring(0,qqq);
arbstrg =
arbstrg+helpstrg; } } } }
return arbstrg; }
hope it'll
help some people ...
|
|
mads@danquah.dk
05-Feb-2002 12:15 |
|
If you want to slash an entire array recursively (as many dimensions as you
want) you could do it like this :
function
array_slash($array)
{
if(is_array($array)){
foreach($array as $key => $val){
$return[$key] =
array_clean($val); // recurse
}
return($return);
}
else{
return(addslashes($array)); // return slash'ed
value
}
}
|
|
ssiruuk@wanadoo.fr
13-Feb-2002 06:27 |
|
addSlashes doesn't work with sybase
you have to replace "'" by
"''"
it is the same thing for oracle
|
|
phpman at priorwebsites.com
19-Mar-2002 12:02 |
|
You MySQL folks might also want to check out
mysql_escape_string().
--------- copied from
mysql_escape_string():
If you're wondering what's the difference between
mysql_escape_string() and
AddSlashes(), I found this from looking at the
source code of MySQL
3.23.32 and PHP 4.0.6:
- mysql_escape_string
calls MySQL's library function of the same name,
which prepends slashes
to the following characters: NUL (\x00), \n, \r, \,
', " and
\x1a.
- AddSlashes escapes NUL, ', " and \.
While
mysql_escape_string seems safer, my experience shows that
escaping
strings with AddSlashes (which is also done automatically
if
magic_quotes_gpc is on) is sufficient, so it seems you can pick
whichever
you wish.
|
|
guy_AT_datalink_DOT_net_DOT_au
30-Mar-2002 08:58 |
|
If you're trying to escape quotes in a javascript event as
such:
<img src=/old?u=http%3A%2F%2Ffr.php.net%2Fmanual%2Fde%2F%26quot%3Bfoo.gif%26quot%3B&y=1999 OnMouseOver="alert('<?
print $myString ?>')">
It helps to perform this
first:
$myString = str_replace("'", "\'",
$myString);
$myString = str_replace('"',
"'+String.fromCharCode(34)+'", $myString);
|
|
nik@robertanthony.com
03-Apr-2002 08:55 |
|
addslashes does not work in Access for inserting fields that contain single
quotes or apostrophes. For Example:
$fieldOne = "Eat At
Joe's";
$fieldTwo = "Delectable Dining at Fabulous
Fares";
$query = "INSERT INTO Table
(fieldOne,fieldTwo)
VALUES
('$fieldOne','$fieldTwo')";
Returns a syntax error. This can
be fixed by using a regular expression to replace the single quote with the
` character (on a QWERTY keyboard -- above the TAB). You can always
replace it back when outputting the information, but it still looks similar
and will be recognizable to users who are not familiar with your
replacement reasoning.
Example (place before the $query
statement):
$fieldOne =
ereg_replace("\'","`",$fieldOne);
|
|
|
30-Jun-2002 06:19 |
|
I think it’s a big prob that addslashes keeps adding slashes if you run it
over and over on the same var. For ex. If magic quotes are on (witch is
usually always) this would happen.. open this script with
?log=joe’s_dog
echo $_GET[‘log’]
would print “joe/’s_dog”
but if
you insert that to a db, and use addslashes like every tutorial says out
there… You end up with a “joe//’s_dog". There needs to be an optional
pram to skip if already slashed, the func below isn’t the best way cuz if
the data inside has /’ in it for some reason it would think addslashes has
gotten to it.. An internal function change is really the only easy way to
fix the slash fight.
Heres a basic func that tell if the info is
already slashed..
function is_slashed($data)
{
if(stripslashes($data) == $data) {
return 0;
} else
{
return 1;
}
}
|
|
Shane43@aol.com
22-Jul-2002 04:19 |
|
I always had the problem of never knowing when slashes had already been
added. I only needed them to be added once, and did not want to add them a
second time. Here's a little function that will make sure your string will
only be escaped once:
function formatSlashes($string){
while(strstr($string,"\\")){
$string=stripslashes($string);
}
return
addslashes($string);
}
|
|
moli@at@counter-strike.dot.hu
05-Sep-2002 02:21 |
|
to insert binary data, probably the safest way in mysql:
INSERT INTO
table SET field = 0x404142434445;
This will set 'ABCDE' value to
field.
|
|
|
|
addcslashes