Re: Is there a way to prevent PHP from doing an addslashes() on all GET or POST fields?

see: magic_quotes_gpc = On ; magic quotes for incoming GET/POST/Cookie data in your php.ini file. -jeremy brand Jeremy Brand :: Sr. Software Engineer :: 408-245-9058 :: jeremy@nirvani.net http://www.JeremyBrand.com/Jeremy/Brand/Jeremy_Brand.html for more - - Begin - Advertisement - - - - - - - - - - - - - - - THIS SPACE FOR SALE - - - NO JOKE Get your own Free, Private email at http://www.smackdown.com/ - - - - - - - - - - - - - End - Advertisement - - - - - On Fri, 1 Dec 2000, Pascal Jolin wrote: > Date: Fri, 1 Dec 2000 15:00:09 -0500 > From: Pascal Jolin <pjolin@e-c.qc.ca> > To: php-general@lists.php.net > Subject: [PHP] Is there a way to prevent PHP from doing an addslashes() on all GET or POST fields? > > I've been working with PHP / pgsql for a while, and always noticed that, > given the following: > > <textarea name=testfield>Testing 'single quotes' in a string</textarea> > > Once posted back to the server, > > $testfield will contain: > > Testing \'single quotes\' in a string > > Since most of those fields were used to write to a pgsql database, it was > really no problem, and the addition of a stripslashes() command to my script > whenever I needed to print the output in a readable form was not a problem. > > But I have migrated my environment to use an ODBC driver to connect to a MS > SQL Server on a Win2K computer. > > The previous $testfield, to be stored properly in an MSSQL environment, > would require a query like this: > > UPDATE TestTable SET TestField = 'Testing ''single quotes'' in a > string' > > i.e. single quotes must not be escaped with a \, but rather doubled. > > I've RTFM and can't locate anything that tells me I can remove (or replace > with a custom function) the automatic addslashes() that's done on all GET > and POST variables. > > Is my best option to add a header to all my PHP pages (that get posts or > get) to stripslashes() all $HTTP_GET_VARS and $HTTP_POST_VARS, and then > parse them to be mssql-compliant? > > Or is there a flag / option / anything that I missed? > > While we're on the subject, has anyone ever written a parser to make a > string MSSQL Server-safe, à la addslashes()? > > Regards, > > Pascal Jolin > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > >