When querying a database should 'stripslashes' AND 'mysql_real_escape_string' always be used together or should you only use 'mysql_real_escape_string'? I read that it can cause the query to break if you use both...

 

I was going to use it like this in a function;

 

<?php
// Function to sanitize standard name data from form
function clean($string)
{
$string = filter_var($string, FILTER_SANITIZE_STRING);	// Sanitize the text data
$string = trim($string);								// Trim empty space before and after
$string = strtolower($string);							// Convert all letters to lowercase
$string = ucfirst($string);								// Convert first letter to uppercase
if(get_magic_quotes_gpc()) {
	$string = stripslashes($string);					        // Stripslashes
}
$string = mysql_real_escape_string($string);			        // mysql_real_escape_string
return $string;
}
?>

When querying a database should 'stripslashes' AND 'mysql_real_escape_string' always be used together or should you only use 'mysql_real_escape_string'? I read that it can cause the query to break if you use both...

 

I was going to use it like this in a function;

 

<?php
// Function to sanitize standard name data from form
function clean($string)
{
$string = filter_var($string, FILTER_SANITIZE_STRING);	// Sanitize the text data
$string = trim($string);								// Trim empty space before and after
$string = strtolower($string);							// Convert all letters to lowercase
$string = ucfirst($string);								// Convert first letter to uppercase
if(get_magic_quotes_gpc()) {
	$string = stripslashes($string);					        // Stripslashes
}
$string = mysql_real_escape_string($string);			        // mysql_real_escape_string
return $string;
}
?>

 

function clean($string){
if(function_exists("mysql_real_escape_string")){
return mysql_real_escape_string($string);
}else{
return addslashes($string);
}
}

 

then i normally use stripslashes for displaying to remove extra slashes

 

$name = stripslashes($row['name']);

function clean($string){
if(function_exists("mysql_real_escape_string")){
return mysql_real_escape_string($string);
}else{
return addslashes($string);
}
}

 

then i normally use stripslashes for displaying to remove extra slashes

 

$name = stripslashes($row['name']);

So you would use addslashes to insert into a database not stripslashes

So you would use addslashes to insert into a database not stripslashes

 

i guess u can use both mysql_real_escape_string and stripslashes at the same time when inserting, but i tend to do it that way its really what u prefer to be honest, addslashes is just for any reason that the function mysql_real_escape string does not exists, most the time mysql_real_escape_string will run

Edited July 17, 201115 yr by webdesigner93

So would I be right in saying that it is best to addslashes when inserting into a database (if mysql_real_escape_string isn't working) and to stripslashes (again if mysql_real_escape_string isn't working) when retrieving from the database, and that addslsahses/stripslashes shouldn't be used WITH mysql_real_escape_string...

So would I be right in saying that it is best to addslashes when inserting into a database (if mysql_real_escape_string isn't working) and to stripslashes (again if mysql_real_escape_string isn't working) when retrieving from the database, and that addslsahses/stripslashes shouldn't be used WITH mysql_real_escape_string...

 

basically u should only use stripslashes if magic_quotes is on, its use to remove any extra back slashes from appearing when magic quotes is on, a simple function like this is all u need really

 

function clean($str){
return mysql_real_escape_string(trim(htmlentities($str,ENT_QUOTES,'UTF-8')));
}

 

stripslashes is for displaying purposes, not for inserting into mysql

Edited July 17, 201115 yr by webdesigner93

Heres a reference on stripslashes http://php.net/manual/en/function.stripslashes.php

Heres a reference on stripslashes http://php.net/manual/en/function.stripslashes.php

 

I was just reading that before i posted this thread, I'm not sure what it is that isn't working in my script.

 

The problem I'm having is names like O'neil in a name field...

I have sanitized it using FILTER_SANITIZE_STRING

I have trimmed it using TRIM

I have added MYSQL_REAL_ESCAPE_STRING

 

and one of my validations is comparing if the data after sanitization is the same as before sanitization...

if (strcasecmp($clean_lastname, mysql_real_escape_string(trim($_POST['lastname']))) != 0) {

$errmsg_arr[] = 'Please enter a valid last name';

$errflag = true;

}

 

and it is saying that my last name isn't valid

 

Thanks for your help so far by the way

Edited July 17, 201115 yr by adamsmith

I'm just echoing out all the combinations to find out the problem right now

Think I have it, it was the FILTER_FLAG_NO_ENCODE_QUOTES

 

O'neil now becomes O\\\'neil is it best to store it in the database like that or is there a better way?