CODEWITHSUNDEEP
php
pks83
pks83

Reputation: 231

Escaping using slashes and then using stripslashes PHP

In my code i am using addslashes to escape certain characters while inserting them into the database and when i send some information out i use stripslashes to remove those slashes, the situation is stripslashes function removes all the slashes so if i need to send any string which has backslashes those also get removed. How can i retain those required slashes.

Any help will be greatly appreciate.

Upvotes: 2

Views: 1865

Answers (4)

troelskn
troelskn

Reputation: 117427

In my code i am using addslashes to escape certain characters while inserting them into the database and when i send some information out i use stripslashes to remove those slashes ...

You're doing it wrong. You must escape strings when you embed them in a query. You do not unescape data when it comes back from the database. There are no slashes to remove. They only exists in the query - not in the database.

Besides that, bound parameters/prepared statements are much better, as already noted by others in this thread.

Upvotes: 2

ian
ian

Reputation: 1675

You can try using PDO prepared statements when inserting to database so you don't need to worry about escaping anything.

Upvotes: 3

RaYell
RaYell

Reputation: 70404

I think it's better to use htmlspecialchars for escaping the data for database storage. You don't have to worry about restoring them after getting them from the database as they will be handled correctly by the browser.

Upvotes: -3

Tyler Carter
Tyler Carter

Reputation: 61557

You might want to try using mysql_real_escape_string. You don't have to unescape it, and it is safe for database use.

Better yet, use prepared statements

Upvotes: 8

Related Questions