Re: Magic quotes and addslashes()

On Thu, 24 Apr 2003, James 'Chip' Kaufman wrote: > On Tuesday 08 April 2003 21:32, John W. Holmes wrote: > > > I'm a developer of a PHP product for commercial use (it's open > > > source though), and I'm wondering which is the best; require the > > > user to > > > > > > enable magic_quotes in PHP or using addslashes() on all data > > > inserted into the database? For the developers, it's one thing less > > > to think of but maybe it could be bad for the users. Thank you in > > > advance. > > > > You're program should handle the data correctly in either case. Use > > get_magic_quotes_gpc() to see if it's enabled or not. If it is, then > > you don't need to do anything. If it's not, then you need to run > > addslashes yourself. This should be transparent to the user. > > > > ---John W. Holmes... > > > > Perhaps I'm a bit tardy in responding to this, but I have been working > on a system that uses Informix as the database, and the above advice > doesn't seem to work for me. > > Informix doesn't like backslashed quotes. Something like "Isn\'t this > nice?" ends up in the db with the backslash. OTOH, it is very happy > having an apostrophe within a quoted string (eg, "Isn't this nice?" > works fine). > > I think the best approach might be to use DB::quote. That surrounds the > string with apostrophes and doubles them up within the string. (eg, > 'Isn''t that nice?) Informix likes that. If you want '' instead of \' then one option would be to enable the magic_quotes_sybase directive as this will change the behavior of all the rest. In otherwords, if magic_quotes_sybase is on then addslashes(), magic_quotes_gpc, etc. will create '' and not the typical \' Regards, Philip