note 76056 deleted from function.serialize by aharvey
| From: | aharvey@php.net | Date: | Tue, 06 Nov 2012 02:11:47 +0000 |
| Subject: | note 76056 deleted from function.serialize by aharvey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-191776@lists.php.net to get a copy of this message | ||
Note Submitter: btbeat at gmail dot com
----
Generally when I do an insert into a database table of posted data, I use the recommended
mysql_real_escape_string function, with stripslashes if the get_magic_quotes_gpc is on.
<?php
function prepData($var) {
if (get_magic_quotes_gpc()) {
$var = stripslashes($var);
}
return mysql_real_escape_string($var);
}
?>
I've been having a problem inserting a serialized array into a MySQL database that contained
single and double quotes for values.
ex: "quotes" => "some 'quoted' "text""
you'd think it would be:
a:1:{s:6:"quotes";s:20:"some 'quoted' "text"";}
as prepData function would strip the slashes.
However, what goes into the database is:
a:1:{s:6:"quotes";s:24:"some 'quoted' "text"";}
as if there are slashes before the single and double quotes.
Obviously on unserializing the data, there is an error, as 24 chars are expected, when there are
only 20.
So, the solution I've coded for my safe insert prepData function is:
<?php
function prepData($var, $serialized = 0) {
if( $serialized == 0 ) {
if (get_magic_quotes_gpc()) {
$var = stripslashes($var);
}
}
return mysql_real_escape_string($var);
}
?>
when inserting plain data from a post:
<? $data = prepData($data); ?>
for serialized data:
<? $data = prepData($data, 1); ?>
cracked my head on this one a bit :|
strange behaviour for serialize(), i.e. string count, counts slashes that are not there.