PHP is adding slashes to characters when inserting into MySQL

Question

When a ' is typed into a text field for example, PHP puts a \ before it.

I'm using the following for filtering:

$comment_body = $_POST['comment_body'];
$comment_body = nl2br(htmlspecialchars($comment_body));
$comment_body = mysqli_real_escape_string($db_conx,$comment_body);

How do I stop this slash from appearing?

The mysqli_real_escape_string function call escapes the single quote with the backward slash to prevent SQL injection. — Tonto
– Tonto, Commented Aug 3, 2013 at 20:45
that is what your mysqli_real_escape_string is doing. It is supposed to be that way — Jacob
– Jacob, Commented Aug 3, 2013 at 20:45
I know that, but I've used it on other sites and the \ isn't posted into the database. Is there a way I can stop it from been posted or a way to stop it from been displayed with the \ without removing the mysqli_real_escape_string? — James
– James, Commented Aug 3, 2013 at 20:47

svecon · Accepted Answer · 2013-08-03 20:50:12Z

1

You should use sanitization with regards to context:

When saving to database use only mysqli_real_escape_string(). When outputing varible to HTML then just go with htmlspecialchars().

Automatic adding of slashes might be due to the settings of magic_quotes_gpc, which is already removed in newer versions of PHP, but you can check your settings in phpinfo();

answered Aug 3, 2013 at 20:50

svecon

5511 gold badge5 silver badges8 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Orangepill Over a year ago

I agree you don't want to store the results of htmlspecialchars and nl2br.

Orangepill · Accepted Answer · 2013-08-03 20:46:44Z

0

The is what mysqli_real_escape_string does. This should only be used when putting the data into a database. If you are going to output the $comment_body just leave off the last line of the snippet. If you are getting double escaping happening it is probably the result of the magic quotes configuration directive.

answered Aug 3, 2013 at 20:46

Orangepill

24.7k3 gold badges44 silver badges64 bronze badges

7 Comments

James Over a year ago

I know that, but I've used it on other sites and the \ isn't posted into the database. Is there a way I can stop it from been posted or a way to stop it from been displayed with the \ without removing the mysqli_real_escape_string? I am actually inserting this into the database by the way

James Over a year ago

That's what's happened then, the server was updated to the latest version of PHP. Is there a way I can hide the \ when querying out of the database?

Orangepill Over a year ago

@James ... that wouldn't be it then magic quotes where removed in 5.4

James Over a year ago

Actually, my bad, it runs 5.4 @Orangepill

Orangepill Over a year ago

@james is it possible someone on the site fixed for the absence of magic quotes by doing something like $_POST = array_map("addslashes", $_POST);?

|

woofmeow · Accepted Answer · 2013-08-03 20:50:52Z

0

It may probably be because you have magic quotes on : magic_quotes_gpc If that is the case you can disable it using this

answered Aug 3, 2013 at 20:50

woofmeow

2,41818 silver badges14 bronze badges

Collectives™ on Stack Overflow

PHP is adding slashes to characters when inserting into MySQL

3 Answers 3

1 Comment

7 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

7 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related