Re: Magic quotes and addslashes()

On Tuesday 08 April 2003 21:32, John W. Holmes wrote: > > I'm a developer of a PHP product for commercial use (it's open > > source though), and I'm wondering which is the best; require the > > user to > > > > enable magic_quotes in PHP or using addslashes() on all data > > inserted into the database? For the developers, it's one thing less > > to think of but maybe it could be bad for the users. Thank you in > > advance. > > You're program should handle the data correctly in either case. Use > get_magic_quotes_gpc() to see if it's enabled or not. If it is, then > you don't need to do anything. If it's not, then you need to run > addslashes yourself. This should be transparent to the user. > > ---John W. Holmes... > Perhaps I'm a bit tardy in responding to this, but I have been working on a system that uses Informix as the database, and the above advice doesn't seem to work for me. Informix doesn't like backslashed quotes. Something like "Isn\'t this nice?" ends up in the db with the backslash. OTOH, it is very happy having an apostrophe within a quoted string (eg, "Isn't this nice?" works fine). I think the best approach might be to use DB::quote. That surrounds the string with apostrophes and doubles them up within the string. (eg, 'Isn''t that nice?) Informix likes that. -- James 'Chip' Kaufman jkaufman@wamnet.com PGP key: 697D43DE