Storing and displaying code using mysql_real_escape_string();

Question

I'm creating a web page that will allow users to paste in their code and be given a unique URL to access it later. The problem is that I am using

mysql_real_escape_string($_POST['code'])

to prevent sql injection but at the same it adds slashes to the code which means when the code is displayed at a later date, it is spoiled (slashes everywhere.)

Is there a way to 'un-escape' it when displaying the code again?

Sorry if this seems unclear or obvious, this is my first project using php.

Please stop using mysql_* functions as they are now deprecated. Use MySQLi or PDO instead. — Jason McCreary
– Jason McCreary, Commented Jul 25, 2012 at 16:29
Are you sure the slashes are from mysql_real_escape_string() or are they in $_POST? — Jason McCreary
– Jason McCreary, Commented Jul 25, 2012 at 16:30
The only thing stripslashes() is an answer to is "how do I fix my goofed up data?". PHP should be configured properly in the first place to not cause this. — Ignacio Vazquez-Abrams
– Ignacio Vazquez-Abrams, Commented Jul 25, 2012 at 16:31

Community · Accepted Answer · 2017-05-23 12:21:13Z

0

It is echo stripslashes($code); you looking for? I think for added security you also have to like convert the special characters to html entities and strip all script tags if necessary to avoid xss attack.

See:

http://php.net/manual/en/function.htmlentities.php

XSS filtering function in PHP

edited May 23, 2017 at 12:21

CommunityBot

11 silver badge

answered Jul 25, 2012 at 16:35

Johndave Decano

2,1032 gold badges16 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Storing and displaying code using mysql_real_escape_string();

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related