More slashes when using mysql_real_escape_string

Question

I'm a little confused with mysql_real_escape_string() function,

I have this array below and filtering it with mysql_real_escape_string() function,

$postFields = array('company', 'type');
$postArray = array();
foreach($postFields as $postVal){
    $_POST[$postVal] = array_map("mysql_real_escape_string", $_POST[$postVal]);
    $postArray[$postVal] = $_POST[$postVal];
}

so the results is like this,

Array
(
    [type] => Array
        (
            [0] => CD
        )

    [code] => Array
        (
            [0] => \\\'\\\' OR \\\'\\\'
        )
)

but when I want to use it single like this,

echo mysql_real_escape_string($postArray['company'][0]);

I'm getting more slashes, like this,

\\\\\\\'\\\\\\\' OR \\\\\\\'\\\\\\\'

Any reason for it, or I just do something wrong.

First, don't use mysql_* functions. They are about to be deprecated. Use PDO or mysqli instead. — Lion
– Lion, Commented Jul 2, 2012 at 21:26
No problem, I know about it, but first I need to fix that one. — itsme
– itsme, Commented Jul 2, 2012 at 21:28
depreciation only matters if your selling software or giving it away to the masses, or are intent on upgrading sooner than later. If you keep the same server you'll be fine. Not to say upgrading is a bad thing, or shouldn't be done. But overall.. it is what it is. — chris
– chris, Commented Jul 2, 2012 at 21:32
stripslashes() may help remove the extras but thats negating what real_escape is there for. — chris
– chris, Commented Jul 2, 2012 at 21:33

Brilliand · Accepted Answer · 2012-07-02 21:37:35Z

3

In the code you provide, you're escaping the string twice:

$postFields = array('company', 'type');
$postArray = array();
foreach($postFields as $postVal){
    $_POST[$postVal] = array_map("mysql_real_escape_string", $_POST[$postVal]);
    $postArray[$postVal] = $_POST[$postVal];
}
echo mysql_real_escape_string($postArray['company'][0]);

Each time you escape the string, all of the backslashes get escaped into two backslashes. Be careful to only escape each string once.

answered Jul 2, 2012 at 21:37

Brilliand

13.8k6 gold badges49 silver badges58 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

More slashes when using mysql_real_escape_string

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related