Is there a way to prevent PHP from doing an addslashes() on all GET or POST fields?

From: Date: Fri, 01 Dec 2000 20:00:09 +0000
Subject: Is there a way to prevent PHP from doing an addslashes() on all GET or POST fields?
Groups: php.general 
Request: Send a blank email to php-general+get-28272@lists.php.net to get a copy of this message
I've been working with PHP / pgsql for a while, and always noticed that, given the following: <textarea name=testfield>Testing 'single quotes' in a string</textarea> Once posted back to the server, $testfield will contain: Testing \'single quotes\' in a string Since most of those fields were used to write to a pgsql database, it was really no problem, and the addition of a stripslashes() command to my script whenever I needed to print the output in a readable form was not a problem. But I have migrated my environment to use an ODBC driver to connect to a MS SQL Server on a Win2K computer. The previous $testfield, to be stored properly in an MSSQL environment, would require a query like this: UPDATE TestTable SET TestField = 'Testing ''single quotes'' in a string' i.e. single quotes must not be escaped with a \, but rather doubled. I've RTFM and can't locate anything that tells me I can remove (or replace with a custom function) the automatic addslashes() that's done on all GET and POST variables. Is my best option to add a header to all my PHP pages (that get posts or get) to stripslashes() all $HTTP_GET_VARS and $HTTP_POST_VARS, and then parse them to be mssql-compliant? Or is there a flag / option / anything that I missed? While we're on the subject, has anyone ever written a parser to make a string MSSQL Server-safe, à la addslashes()? Regards, Pascal Jolin

« previous php.general (#28272) next »