CODEWITHSUNDEEP
phpmysqlwordpressmagic-quotes-gpcmagic-quotes
johnbell
johnbell

Reputation: 9

Wordpress escaping quoting ONLY when inserting into the database

here's another problem: I have built a custom plugin... all works except when I update a record everything gets escaped and magic quoted.

I have stripslahsed_deep the $_POST and the rest, however it seems I can see the query ACTUALLY going in by a mistake (SET Id on update - which I know I have to fix). At any rate all the magic quotes are in... how can I remove them?

Here's the var_dump of the query JUST BEFORE it is executed.

array(14) {
["id"]=> string(4) "'10'"
["number"]=> string(4) "'44'"
["title"]=> string(16) "'pippoasdasddad'"
["description"]=> string(7) "'pippo'"
["type"]=> string(11) "'Book Club'"
["platform"]=> string(7) "'pippo'"
["airdate"]=> string(12) "'2023-02-16'"
["duration"]=> string(7) "'17:38'"
["shownotes"]=> string(7) "'pippo'"
["authors"]=> string(20) "'Andy, Diego, Wiedo'"
["image_small"]=> string(7) "'pippo'"
["image_big"]=> string(7) "'pippo'"
["stream_link"]=> string(7) "'pippo'"
["published"]=> bool(false) }

And here is the error that shows what is ACTUALLY going in.

WordPress database error: [Duplicate entry '0' for key 'PRIMARY']
UPDATE `wp_ngof_episodes` SET `id` = '\'10\'', `number` = '\'44\'', `title` = '\'pippoasdasddad\'', `description` = '\'pippo\'', `type` = '\'Book Club\'', `platform` = '\'pippo\'', `airdate` = '\'2023-02-16\'', `duration` = '\'17:38\'', `shownotes` = '\'pippo\'', `authors` = '\'Andy, Diego, Wiedo\'', `image_small` = '\'pippo\'', `image_big` = '\'pippo\'', `stream_link` = '\'pippo\'', `published` = '' WHERE `id` = '10'

I tried the deepslashes removal

$POST = array_map('stripslashes_deep', $_POST); and then used that $POST variable... no luck

Any ideas?

Upvotes: 0

Views: 31

Answers (1)

johnbell
johnbell

Reputation: 9

Well I am answering my own question as I realised I was the one actually adding the quotes... what a plonker, took me hours to find out. Here it is:

Original

if (isset($_POST[$field['name']])) {
   $data[$field['name']] = "'".stripslashes_deep($_POST[$field['name']])."'";
} else {
  $data[$field['name']] = false;
}

To

if (isset($_POST[$field['name']])) {
   $data[$field['name']] = stripslashes_deep($_POST[$field['name']]);
} else {
  $data[$field['name']] = false;
}

Upvotes: -2

Related Questions