note 37018 deleted from function.stripslashes by aidan

Note Submitter: nkruse LOCATED AT nakdesign POINT net ---- I just sorted through a pretty thorny problem related to many above posts. I know this isn't all that advanced but I thought I'd share it so no other PHP neophytes have to scratch their heads for a couple hours. I have an online registration system with three pages. Page 1 is a regular form with submit, etc. Page 2 displays what the user entered and asks for verification that the info is correct. It echoes the info in hidden fields in a form with a "submit if OK" button. Page 3 enters the info into a mySQL DB. To pass the info from page 2 to page 3, I used this code, which was actually taken from a post elsewhere on this site: reset($HTTP_POST_VARS); while (list($name, $value) = each($HTTP_POST_VARS)) { if ($value == "blank" || $value == "") $value = "not entered"; if (!is_array($value)) echo "<input type=\"hidden\" value=\"$value\" name=\"$name\">\n"; else while (list ($nme, $val) = each ($HTTP_POST_VARS[$name])) echo "<input type=\"hidden\" value=\"$val\" name=\"${name}[${nme}]\">\n"; } However, I later found out that if any of the text fields have escapable characters, everything after the character is dropped. It was all the more baffling because I was seeing things like \\" etc. I eventually realized that, in passing the info twice (p1 > p2, then p2 > p3), the slash escaping the quote was then itself getting escaped. So when I did stripslashes on p3 (the wrojng place!), it just went from \\\" to \\". I added htmlspecialchars and stripslashes the code to convert quotes correctly in this two-step process: reset($HTTP_POST_VARS); while (list($name, $value) = each($HTTP_POST_VARS)) { if ($value == "blank" || $value == "") $value = "not entered"; if (!is_array($value)) echo "<input type=\"hidden\" value=\"" . htmlspecialchars(stripslashes($value)) . "\" name=\"$name\">\n"; else while (list ($nme, $val) = each ($HTTP_POST_VARS[$name])) echo "<input type=\"hidden\" value=\"" . htmlspecialchars(stripslashes($val)) . "\" name=\"${name}[${nme}]\">\n"; } HTH, [N]