Re: DataObject adding extra slashes

On Wed, 30 Mar 2005 10:41:55 +1000, Dan Rossi <pear@electroteque.org> wrote: > It has come to my attention, when I used setFrom($_POST) > > some of the data is already adding slashes to quotes when posted, > DataObject however is already adding slashes is there a way to stop > this ? > > Here is something in a function i had used for generating sql from post > arrays, it was dodgy but worked :| > > if (!get_magic_quotes_gpc()) { > $vals .= > "'".addslashes($value)."'".$delimiter; > } else { > $vals .= > "'".$value."'".$delimiter; > } > > should this be patched to dataobject or MDB2 or DB quote method ? > Magic quotes is really not something that should be used. Period. Please read my FAQs about it (and other things). http://opensource.21st.de/tiki-index.php?page=PHPFAQs DB_DataObject uses DB's quoteSmart method to escape quotes correctly for the database you're using. While Mysql is basically the same as addslashes (which is what magic_quotes does) Oracle, for instance, uses double single quotes for a single quote in data. 'don''t you like quotes?' It does this because it assumes that what you give it is the data you want to insert. There is no reason this should be turned off. If you can't turn off magic_quotes (which I strongly suggest you do) then you should run stripslashes in your $_POST array before using it. (Additionally you should do the same on $_GET, $_REQUEST, and $_COOKIE if you use them). -- Justin Patrin