CODEWITHSUNDEEP
phpmysqlsql-injection
frankmeacey
frankmeacey

Reputation: 161

SQL injection help

So I was just testing out the mysql_real_escape(); function and what that does is puts a \ before the ". The when the content is echoed back out onto the page I just get content with \'s before any ". So let's say I posted """""""""""""""""""""""""""" all I get is \"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\" echoed back.

Is there some code to remove the \ when it's echoed back onto the page?

Upvotes: 0

Views: 115

Answers (4)

Jeremy Banks
Jeremy Banks

Reputation: 129715

By adding those slashes, mysql_real_escape_string just converts the string into the input format for the database. When the data comes out of the database, it should come out without any of the slashes. You shouldn't need to remove them yourself.

Using stripslashes like others are suggesting would do the opposite of mysql_real_escape_string in most cases, but not all of them, and you shouldn't rely on it for that purpose. Mind you, if you find yourself needing to use it for this, you've already done something else wrong.

Upvotes: 4

null
null

Reputation: 11839

Do you know how mysql_real_escape() works. Hint: It allows to encode string for SQL usage. For example mysql_query('SELECT * FROM users WHERE name="'.mysql_real_escape_string($name).'"');. It can be used to insert string which won't escape the quotes for example like " or 1=1 -- " making SELECT * FROM users WHERE name="" or 1=1. You have to activate it just before inserting it database.

When you will read this data, slashes won't exist in any way.

Actually, looking at what is below, I will make this answer, not comment...

Upvotes: 0

JJ.
JJ.

Reputation: 5475

You don't need to unescape, ie. remove the slashes - they don't get inserted into the DB. They are only for passing data to MySQL, they are not written to the db. When you SELECT the data, you won't see the slashes.

Upvotes: 1

JConstantine
JConstantine

Reputation: 3931

stripslashes()

http://php.net/manual/en/function.stripslashes.php

Upvotes: 1

Related Questions