Re: Request to bash/jump/screw my code
| From: | ceo at l-i-e dot com | Date: | Mon, 08 Dec 2008 23:30:45 +0000 |
| Subject: | Re: Request to bash/jump/screw my code | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-284332@lists.php.net to get a copy of this message | ||
> * Your output isn't cleaned up when coming from the database. You need
> to put a few stripslashes() instances in there.
Actually, if you think you have to use stripslashes, then, in fact, you've used addslashes
and/or Magic Quotes TWICE, and your db has BAD DATA in it.
Fix the data intake routines to escape your data ONCE, properly, using the db escape routine (like
http://php.net/mysql_real_escape_string).
ANY time you find yourself using stripslashes, you messed up way back in the production line, and
need to pull the big red handle and fix the process way before where you are now.