output escaping problem
6 Message(s) by 4 Author(s) originally posted in php sql
| From: Pugi! |
Date: Monday, August 13, 2007
|
Before I save input from a form to a
data base I use (after input
filtering) mysql_
real _escape_
string .
This means that blabla 'blabla' ... -> blabbla \'blabla\' ...
To
display this data from database in
browser , I use stripslashes and
htmlentities.
So far so good.
But what if input is for example a location:
D:\data\folder\
file .exe. Escaped this becomes D:\\data\\folder\
\file.exe
No problem here, but how can I display this in a browser again ?
Stripslashes removes \ as well as \\, so I am left with
D:datafolderfile.exe This isn't what I want, I want it to show D:\data
\folder\file.exe.Pugi!
| From: Rik |
Date: Monday, August 13, 2007
|
wrote in message:
Before I save input from a form to a database I use (after input
filtering) mysql_real_escape_string.
This means that blabla 'blabla' ... -> blabbla \'blabla\' ...
No, it means the characters that need escaping are escaped when inserting
in the database, so the data in the database is _the_same_ as your
original string. Unless somthing like magic_quotes_gpc() is enabled, in
which case you should use stripslashes() on the string before using
mysql_real_escape_string() on it.
To display this data from database in browser, I use stripslashes and
htmlentities.
So far so good.
Nope, just drop the stripslashes.
--
Rik Wasmus
| From: charlespb69 |
Date: Tuesday, August 14, 2007
|
wrote in message:
wrote in message:
> Before I save input from a form to a database I use (after input
> filtering) mysql_real_escape_string.
> This means that blabla 'blabla' ... -> blabbla \'blabla\' ...
No, it means the characters that need escaping are escaped when inserting
in the database, so the data in the database is _the_same_ as your
original string. Unless somthing like magic_quotes_gpc() is enabled, in
which case you should use stripslashes() on the string before using
mysql_real_escape_string() on it.
> To display this data from database in browser, I use stripslashes and
> htmlentities.
> So far so good.
Nope, just drop the stripslashes.
--
Rik Wasmus
When using mysql_real_escape_string you do not need to use stripslashes
| From: Michael Fesser |
Date: Tuesday, August 14, 2007
|
.oO(charlespb69)
When using mysql_real_escape_string you do not need to use stripslashes
Depends on the setting of magic quotes. If they are enabled, you should
use stripslashes() before doing anything else.
Micha
| From: Rik |
Date: Wednesday, August 15, 2007
|
wrote in message:
.oO(charlespb69)
When using mysql_real_escape_string you do not need to use stripslashes
Depends on the setting of magic quotes. If they are enabled, you should
use stripslashes() before doing anything else.
Yup, and they're a big pain, so if you get the chace, disable those magic
bastards. Getting the real data provided is in the end so much easier.
--
Rik Wasmus
| From: charlespb69 |
Date: Thursday, August 16, 2007
|
wrote in message:
wrote in message:
> .oO(charlespb69)
When using mysql_real_escape_string you do not need to use stripslashes
> Depends on the setting of magic quotes. If they are enabled, you should
> use stripslashes() before doing anything else.
Yup, and they're a big pain, so if you get the chace, disable those magic
bastards. Getting the real data provided is in the end so much easier.
--
Rik Wasmus
With my hosting
provider I have access to the php.ini file so I can
turn off magic-quotes.
Next Message: Remote connection by proxy script.
Blogs related to output escaping problem
BigDump: Staggered MySQL Dump Importer
Note 6: If you experience
problems with non-latin characters while using BigDump you have to adjust the $db_connection_char_set configuration variable in bigdump.
php to match the encoding of your dump file. FAQ Q: I get an error: MySQL:
...
Re: xsl-list Digest 14 May 2007 05:10:00 -0000 Issue 1
I understand the
problem with the 'disable-out-
escaping', in this particular example there is no need for it because those targeted characters don't exist. Yes, I'm going back to Jeni's page to review her methods.
...
RE: Re; Grouping Titles under Correct Category
>'Disable-
output-
escaping' is used to mask specific HTML characters that appear in the HTML
output. For example '&' Well, none of your titles contains any characters that need to be escaped, so disabling
escaping has no effect.
...
Re: Preventing CDATA output in XHTML
I've poured through the FAQs and have tried everything suggested: Wrapping in
, wrapping in an HTML comment, using the disable-output-escaping=yes attribute on , etc. XSL such as this: