Sagewire Logo

output escaping problem

6 Message(s) by 4 Author(s) originally posted in php sql


From: Pugi! Date:   Monday, August 13, 2007
Before I save input from a form to a data base I use (after input
filtering) mysql_real _escape_string .
This means that blabla 'blabla' ... -> blabbla \'blabla\' ...
To display this data from database in browser , I use stripslashes and
htmlentities.
So far so good.

But what if input is for example a location:
D:\data\folder\file .exe. Escaped this becomes D:\\data\\folder\
\file.exe
No problem here, but how can I display this in a browser again ?
Stripslashes removes \ as well as \\, so I am left with
D:datafolderfile.exe This isn't what I want, I want it to show D:\data
\folder\file.exe.Pugi!


From: Rik Date:   Monday, August 13, 2007
wrote in message:

Before I save input from a form to a database I use (after input
filtering) mysql_real_escape_string.
This means that blabla 'blabla' ... -> blabbla \'blabla\' ...



No, it means the characters that need escaping are escaped when inserting
in the database, so the data in the database is _the_same_ as your
original string. Unless somthing like magic_quotes_gpc() is enabled, in
which case you should use stripslashes() on the string before using
mysql_real_escape_string() on it.

To display this data from database in browser, I use stripslashes and
htmlentities.
So far so good.



Nope, just drop the stripslashes.
--
Rik Wasmus


From: charlespb69 Date:   Tuesday, August 14, 2007
wrote in message:
wrote in message:
> Before I save input from a form to a database I use (after input
> filtering) mysql_real_escape_string.
> This means that blabla 'blabla' ... -> blabbla \'blabla\' ...
No, it means the characters that need escaping are escaped when inserting
in the database, so the data in the database is _the_same_ as your
original string. Unless somthing like magic_quotes_gpc() is enabled, in
which case you should use stripslashes() on the string before using
mysql_real_escape_string() on it.
> To display this data from database in browser, I use stripslashes and
> htmlentities.
> So far so good.
Nope, just drop the stripslashes.
--
Rik Wasmus



When using mysql_real_escape_string you do not need to use stripslashes


From: Michael Fesser Date:   Tuesday, August 14, 2007
.oO(charlespb69)

When using mysql_real_escape_string you do not need to use stripslashes



Depends on the setting of magic quotes. If they are enabled, you should
use stripslashes() before doing anything else.

Micha


From: Rik Date:   Wednesday, August 15, 2007
wrote in message:

.oO(charlespb69)
When using mysql_real_escape_string you do not need to use stripslashes
Depends on the setting of magic quotes. If they are enabled, you should
use stripslashes() before doing anything else.



Yup, and they're a big pain, so if you get the chace, disable those magic
bastards. Getting the real data provided is in the end so much easier.
--
Rik Wasmus


From: charlespb69 Date:   Thursday, August 16, 2007
wrote in message:
wrote in message:
> .oO(charlespb69)
When using mysql_real_escape_string you do not need to use stripslashes
> Depends on the setting of magic quotes. If they are enabled, you should
> use stripslashes() before doing anything else.
Yup, and they're a big pain, so if you get the chace, disable those magic
bastards. Getting the real data provided is in the end so much easier.
--
Rik Wasmus



With my hosting provider I have access to the php.ini file so I can
turn off magic-quotes.



Next Message: Remote connection by proxy script.


Blogs related to output escaping problem

BigDump: Staggered MySQL Dump Importer
Note 6: If you experience problems with non-latin characters while using BigDump you have to adjust the $db_connection_char_set configuration variable in bigdump.php to match the encoding of your dump file. FAQ Q: I get an error: MySQL: ...

Re: xsl-list Digest 14 May 2007 05:10:00 -0000 Issue 1
I understand the problem with the 'disable-out-escaping', in this particular example there is no need for it because those targeted characters don't exist. Yes, I'm going back to Jeni's page to review her methods. ...

RE: Re; Grouping Titles under Correct Category
>'Disable-output-escaping' is used to mask specific HTML characters that appear in the HTML output. For example '&' Well, none of your titles contains any characters that need to be escaped, so disabling escaping has no effect. ...

Re: Preventing CDATA output in XHTML
I've poured through the FAQs and have tried everything suggested: Wrapping in , wrapping in an HTML comment, using the disable-output-escaping=yes attribute on , etc. XSL such as this: