I'm going crazy here ...

 

I simply want to UPDATE data in a table:

 

$w = mysqli_real_escape_string($dbc, trim($_POST['welcome']));

$q = "UPDATE body_text SET welcome='$w', news='$ne' WHERE body_text_id=$id LIMIT 1";

 

 

When I do this I get a backslash every time I enter a singe or double quotation mark (') or (").

 

I can't make stripslashes() work ... I'm not really sure where it goes.

 

I also need page return (ie hitting enter) to work too - at the moment it is going into the table with a return, but not when being called?

 

Any help please ...

 

PHP v 5.2.5

Ok I've mannaged to work out using

 

echo nl2br($row['w'])

 

to show the line breakes correctly.

 

Still not solved the slashes ...

Ok ...

After trying to solve this all day, I manage to solve it 1 hour after posting. If anyone is interested:

 

$w = mysqli_real_escape_string($dbc, stripslashes(trim($_POST['welcome'])));

 

This is probably not the neatest solution ... but it works.

I don't get it - the whole point of mysql_real_escape_string is that it adds the slashes. Why would you want to use it and then reverse the effect before you've even run your query?

 

Maybe I'm missing whatever it was you were trying to achieve?

I thought mysql_real_escape_string removes other stuff to make the code safer? I'm new to this and was never really told what it did, just that you should always use it ...

Yes - m_r_e_s (shortened for my sanity) does help make things safer, and you should use it, but you're using it and then reversing the effect before you put your data in the database so you might as well not bother.

 

You should use the function on the data when you send it to the database.. so

 

$mystuff = mysql_real_escape_string($_POST['field']);
mysql_query("INSERT INTO `table` VALUES ('$mystuff')", $connect);

 

and then use stripslashes() afterwards when you're pulling the data back out again, to display. E.g.

 

$getstuff = mysql_query("SELECT * FROM `table`", $connect);
while ($r = mysql_fetch_assoc($getstuff)) {
echo stripslashes($r['field']);
}

 

So the data *should* be stored with slashes before ' " etc

Jem, can you help me insert that into my code - this is as close as I have got - I'm sure it is pretty close?

 

Thanks for your help so far...

 

Entering the Data:

 

if (isset($_POST['submitted'])) {

if (empty($_POST['welcome'])) {

$errors[] = 'Please enter a welcome message.';

} else {

$w = mysqli_real_escape_string($dbc, trim($_POST['welcome']));

$q = "UPDATE body_text SET welcome='$w' WHERE body_text_id=$id LIMIT 1";

 

$r = @mysqli_query($dbc, $q);

 

Retrieving the Data on the same page (editing text page):

 

$q = "SELECT welcome, news, recommends, guest_writer, previews, live_reviews, cd_reviews, about, contacts, competition FROM body_text WHERE body_text_id=$id";

$r = @mysqli_query ($dbc, $q);

if (mysqli_num_rows($r) == 1) { // Valid user ID, show the form.

 

// Get the user's information:

$row = mysqli_fetch_array ($r, MYSQLI_NUM);

echo '<form action="edit_text2.php" method="post">

<p>Welcome: <br /><textarea name="welcome" rows="10" cols="50" value= > 'stripslashes('.$row['0'].')' </textarea> </p>

<p><input type="submit" name="submit" value="Submit" /></p>

<input type="hidden" name="submitted" value="TRUE" />

 

 

Retrieving the data on another page (but not editable):

 

$q = "SELECT news AS n, welcome AS w FROM body_text";

$r = @mysqli_query ($dbc, $q);

echo stripslashes(nl2br($row['w']));

Change this bit here: 'stripslashes('.$row['0'].')'

 

to: '.stripslashes($row[0]).'

Fantastic ... that works!

Sorry to be so pathetic about this, but how do I insert the stripslashes () into this ( for band_name and music_description):

 

 

$q = "SELECT band_id, genera, band_name, music_description FROM band_members ORDER BY genera , band_name";

$r = mysqli_query($dbc, $q);

 

$currentGenre = '';

while ($messages = mysqli_fetch_array($r, MYSQLI_ASSOC)) {

if ($currentGenre != $messages['genera']) {

echo "<h2>{$messages['genera']}</h2>\n";

$currentGenre = $messages['genera'];

}

echo "<a href=bandinfo.php?id={$messages['band_id']}><h5>{$messages['band_name']}</h5></a> {$messages['music_description']}<br /><br />\n";

}

 

I've tried umteen different ways but cannot get the syntax correct ...

Change {$messages['band_name']} to ".stripslashes($messages['band_name'])."

 

and {$messages['music_description']} to ".stripslashes($messages['music_description'])."

Absolutly fantastic - sorted!

 

Thanks Jem