Is there a way to prevent PHP from doing an addslashes() on all GET or POST fields?
| From: | Pascal Jolin | Date: | Fri, 01 Dec 2000 20:00:09 +0000 |
| Subject: | Is there a way to prevent PHP from doing an addslashes() on all GET or POST fields? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-28272@lists.php.net to get a copy of this message | ||
I've been working with PHP / pgsql for a while, and always noticed that,
given the following:
<textarea name=testfield>Testing 'single quotes' in a string</textarea>
Once posted back to the server,
$testfield will contain:
Testing \'single quotes\' in a string
Since most of those fields were used to write to a pgsql database, it was
really no problem, and the addition of a stripslashes() command to my script
whenever I needed to print the output in a readable form was not a problem.
But I have migrated my environment to use an ODBC driver to connect to a MS
SQL Server on a Win2K computer.
The previous $testfield, to be stored properly in an MSSQL environment,
would require a query like this:
UPDATE TestTable SET TestField = 'Testing ''single quotes'' in a
string'
i.e. single quotes must not be escaped with a \, but rather doubled.
I've RTFM and can't locate anything that tells me I can remove (or replace
with a custom function) the automatic addslashes() that's done on all GET
and POST variables.
Is my best option to add a header to all my PHP pages (that get posts or
get) to stripslashes() all $HTTP_GET_VARS and $HTTP_POST_VARS, and then
parse them to be mssql-compliant?
Or is there a flag / option / anything that I missed?
While we're on the subject, has anyone ever written a parser to make a
string MSSQL Server-safe, à la addslashes()?
Regards,
Pascal Jolin