note 106834 deleted from function.str-replace by danbrown
| From: | danbrown@php.net | Date: | Sun, 11 Dec 2011 19:10:44 +0000 |
| Subject: | note 106834 deleted from function.str-replace by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-185027@lists.php.net to get a copy of this message | ||
Note Submitter: jwzumwalt at neatinfo dot com
----
sqlite_escape_string() does not catch all HTML characters that may
conflict with a browser display. Notice the difference with the
custom routine below.
# php lib command
$str = "Advoid! /slashes\, 'single' and these <too>";
$str = sqlite_escape_string($str);
echo "<br>$str<br>";
# custom function
$str = "Advoid! /slashes\, 'single' and these <too>";
$str = clean($str);
echo "<br>$str<br>";
function clean($str) {
$search = array('&' , '"' , "'" ,
'<' , '>' );
$replace = array('&', '"', ''',
'<', '>' );
$str = str_replace($search, $replace, $str);
return $str;
}
Output:
Advoid! /slashes\, "single" and these
Advoid! /slashes\, 'single' and these <too>