CODEWITHSUNDEEP
phpaddslashes
Michael Irigoyen
Michael Irigoyen

Reputation: 22947

PHP 'addslashes' not behaving as expected

This has been driving be crazy, but I can't seem to find an answer. We run a technical knowledge base that will sometimes include Windows samba paths for mapping to network drives.

For example: \\servername\sharename

When we include paths that have two backslashes followed by each other, they are not escaped properly when running 'addslashes'. My expected results would be "\\\\servername\\sharename", however it returns "\\servername\\sharename". Obviously, when running 'stripslashes' later on, the double backslash prefix is only a single slash. I've also tried using a str_replace("\\", "\", $variable); however it returns "\servername\sharename" when I would expect "\\servername\sharename".

So with addslashes, it ignores the first set of double-backslashes and with str_replace it changes the double-backslashes into a single, encoded backslash.

We need to run addslashes and stripslashes for database insertion; using pg_escape_string won't work in our specific case.

This is running on PHP 5.3.1 on Apache.

EDIT: Example Code
$variable = 'In the box labeled Folder type: \\servername\sharename';
echo addslashes($variable);
This returns: In the box labeled Folder type: \\servername\\sharename

EDIT: Example Code #2
$variable = 'In the box labeled Folder type: \\servername\sharename';
echo str_replace('\\', '\', $variable);
This returns: In the box labeled Folder type: \servername\sharename

I'd also like to state that using a single quotes or double-quotes does not give me different results (as you would expect). Using either or both give me the same exact results.

Does anyone have any suggestions on what I can possibly do?

Upvotes: 1

Views: 3590

Answers (4)

Michael Irigoyen
Michael Irigoyen

Reputation: 22947

I've determined, with more testing, that it indeed is with how PHP is handling hard-coded strings. Since hard-coded strings are not what I'm interested in (I was just using them for testing/this example), I created a form with a single text box and a submit button. addslashes would correctly escape the POST'ed data this way.

Doing even more research, I determined that the issue I was experiencing was with how PostgreSQL accepts escaped data. Upon inserting data into a PostgreSQL database, it will remove any escape characters it is given when it actually places the data in the table. Therefore, stripslashes is not required to remove escape characters when pulling the data back out.

This problem stemmed from code migration from PHP 4.1 (with Magic Quotes on) to PHP 5.3 (with Magic Quotes deprecated). In the existing system (PHP4), I don't think we were aware that Magic Quotes were on. Therefore, all POST data was being escaped already and then we were escaping that data again with addslashes before inserting. When it got inserted into PostgreSQL, it would strip one set of slashes and leave the other, therefore requiring us to stripslashes on the way out. Now, with Magic Quotes off, we escape with addslashes but are not required to use stripslashes on the way out.

It was very hard to organize and determine exactly where the problem lay, so I know this answer is a little off to my original question. I do, however, thank everyone who contributed. Having other people sound off on their ideas always helps to make you think on avenues you may not have on your own.

Upvotes: -1

Mike C
Mike C

Reputation: 1778

This is not a problem with addslashes, it is a problem with the way you are assigning the string to your variable.

$variable = 'In the box labeled Folder type: \\servername\sharename';
echo $variable;

This returns: In the box labeled Folder type: \servername\sharename

This is because the double backslash is interpreted as an escaped backslash. Use this assignment instead.

$variable = 'In the box labeled Folder type: \\\\servername\\sharename';

Upvotes: 1

Mark Grey
Mark Grey

Reputation: 10257

Ran a test on the problem you described, and the only way I could get the behavior you desired was to couple a conditional with a regex and anticipate the double slashes at the start.

$str = '\\servername\sharename';
    if(substr($str,0,1) == '\\'){
    //String starts with double backslashes, let's append an escape one.
    //Exclaimation used for demonstration purposes.
    $str = '\\'.$str;
    echo addslashes(preg_replace('#\\\\\\\\#', '!',$str ));

    }

This outputs:

!servername\\sharename

While this may not be an outright answer, it does work and illustrates a difference in how the escape character is treated by these two constructs. If used, the ! could easily be replaced with the desired characters using another regex.

Upvotes: 1

petraszd
petraszd

Reputation: 4287

I think I know where is a problem. Just try to run this one:

echo addslashes('\\servername\sharename');

And this one

echo addslashes('\\\\servername\sharename');

PHP escapes double slashes even with single quotes, because it is used to escape single quote.

Upvotes: 1

Related Questions