Re: [QuickForm] How should i use applyFilter()

Bertrand Mansion wrote: >> Shouldn't be following line in setDefaults removed? >> $value = is string($value) ? stripslashes($value) : $value; > >I don't think so. Most of the time, default values come from a DB result and >they are necessarily backslashed. The other times, they come from the user >code and they usually don't have backslashes. Then stripslashes doesn't >affect them. Most of the time, you don't want backslashes values in your >forms. Don't you ? I don't want backslashes that are results of magic_quotes_* settings. But I do want my backslash in following code: $foo = 'Here is a backslash: \\'; echo $foo; // result: "Here is a backslash: \" $form->setDefaults(array( 'test' => $foo )); $form->addElement('text', 'test'); // result: "Here is a backslash: " As you can see my backslash disapears. The workaround is: $form->setDefaults(array( 'test' => addslashes($foo) )); Function setDefaults($values, $filter) could be a solution. >magic quotes gpc is on by default on many servers. Users who set it to off >know what they are doing. They will surely need to adapt their code to the >default behaviour. I don't think it's QuickForm business to override their >settings. Shouldn't be QuickForm independent of server setting? Especially that on some servers user can't set magic_quotes (only the admin can), and it can't be set in the code. Take a look at: http://robot.inbud.net.pl/qf/gpc_on/index.php And take a look at: http://robot.inbud.net.pl/qf/gpc_off/index.php It will be great if the values after submit are the same as before submit independent of any settings. So i propose to change two lines in HTML_QuickForm_element() method to this: $submitValue = get_magic_quotes_gpc() ? stripslashes($vars[$this->getName()]) : $vars[$this->getName()]; $this->setValue($submitValue); >We also have the option to let the user handle the slashes himself and then >we get rid of every calls to stripslashes and addslashes in QuickForm. I >don't know what's best ? If anyone has any idea... I think that we can't get rid of stripslashes/addslashes, but we can let the user decide if he wants slashes or not. Maybe something like this: function getSubmitedValue($name, $quotes = null) { if (is_null($quotes)) { // user wants quotes same as server setting return $this->_submitValues[$name]; } else if (!$quotes) { // user does not want quotes return get_magic_quotes_gpc() ? stripslashes($this->_submitValues[$name]) : $this->_submitValues[$name]; } else { // user wants quotes return get_magic_quotes_gpc() ? $this->_submitValues[$name] : addslashes($this->_submitValues[$name]); } } So i can use getSubmitedValue('test', false) and be sure that my code will work on each server.