note 50088 deleted from ref.info by philip
| From: | philip@php.net | Date: | Wed, 29 Mar 2006 18:51:47 +0000 |
| Subject: | note 50088 deleted from ref.info by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-106957@lists.php.net to get a copy of this message | ||
Note Submitter: kok at mostware dot nl
----
It's easy to get confused in all the magic_quotes settings. Therefor, I used this script to
clear things up a little. Hope it helps!
Note 1: Use a simple costumer database table with as costumer_id and a costumer_name, named
costumer.
Note 2: You'll manually have to set magic_quotes_gpc in the php.ini, since it cannot be changed
at runtime. Change it, restart your webserver, run again and see the difference. ;)
-----
<?php
function new_attempt() {
// Show what the settings are
echo 'get_magic_quotes_gpc = ' . get_magic_quotes_gpc() . '<br>';
echo 'get_magic_quotes_runtime = ' . get_magic_quotes_runtime() .
'<br>';
// Put userinput in var and show this
$userinput = $_POST['userinput'];
echo "userinput = $userinput<br>";
// Update without addslashes
echo '<i>Update without addslashes</i><br>';
$sql = "update costumer set costumer_name = '$userinput' where costumer_id =
1";
echo "sql = $sql<br>";
echo 'mysql_query = ' . mysql_query ( $sql ) . '<br>';
// Update with addslashes
echo '<i>Update with addslashes</i><br>';
$sql = "update costumer set costumer_name = '" . addslashes($userinput) .
"' where costumer_id = 2";
echo "sql addslashes = $sql<br>";
echo 'mysql_query = ' . mysql_query ( $sql ) . '<br>';
// Select without stripslashes 2
echo '<i>Select without stripslashes 2</i><br>';
$sql = "select costumer_name from costumer where costumer_id = 2";
echo "sql = $sql<br>";
$resquery = mysql_query ( $sql );
echo 'mysql_query = ' . $resquery . '<br>';
$resfetch = mysql_fetch_array( $resquery );
echo 'mysql_fetch_array = ' . $resfetch . '<br>';
echo 'array[\'costumer_name\'] = ' . $resfetch['costumer_name'] .
'<br>';
// Select with stripslashes 2
echo '<i>Select with stripslashes 2</i><br>';
$sql = "select costumer_name from costumer where costumer_id = 2";
echo "sql = $sql<br>";
$resquery = mysql_query ( $sql );
echo 'mysql_query = ' . $resquery . '<br>';
$resfetch = mysql_fetch_array( $resquery );
echo 'mysql_fetch_array = ' . $resfetch . '<br>';
echo 'array[\'costumer_name\'] stripslashes = ' .
stripslashes($resfetch['costumer_name']) . '<br>';
}
?>
<html>
<head>
<title>slashes test</title>
</head>
<body>
<?php
if ( $_POST ) {
// database connection
mysql_connect ( 'server' , 'user' , 'pass' );
mysql_select_db ( 'database' );
// Try both options
echo '<p><b>set_magic_quotes_runtime = 0</b><br>';
set_magic_quotes_runtime(0);
new_attempt();
echo '</p><p><b>set_magic_quotes_runtime = 1</b><br>';
set_magic_quotes_runtime(1);
new_attempt();
echo '</p>';
}
?>
<p> </p>
<form method="post" name="slashes_form" action="slashes.php">
<input type="text" name="userinput"
value="<?=$_POST['userinput']?>"/>
<input type="submit" name="submit" value="test">
</form>
</body>
</html>