Re: QF/DataObject mangling input chars

On 5/20/05, Ken Restivo <ken@restivo.org> wrote: > On Thu, May 19, 2005 at 10:02:52PM -0700, Justin Patrin wrote: > > On 5/18/05, Ken Restivo <ken@restivo.org> wrote: > > > I'm really confused by a strange bit of behaviour from QF when used with > > > DataObject. > > > > > > I'm trying to save a text field that has formatting in it: mostly carriage > > > returns and tabs and quotations and some html special chars. > > > > > > As far as I can tell, the \n\r's are passed as actual NL/CR characters in the > > > $vars argument to the QuickForm::process() method. But, then when I actually assign the vars to the > > > DataObject, somehow the NL/CR get turned into actual literal '\', 'n', > > > '\', 'r' characters: 4 chars instead of 2. I have no idea why DataObject is > > > doing that, but it's making me crazy. The stuff then gets saved to the database that way: > > > utterly useless. > > > > > > Somewhere, probably inside DataObject, some magic is happening, and it's Bad > > > magic. What's going on here? > > > > > > > Ummm....no, DataObject does not normally do this. I'm using > > DB_DataObject (with FormBuilder) to enter all sorts of data, often > > including newlines. You should probably check your magic_quotes > > settings. > > > > What DB are you using? Perhaps DB's quoting method is incorrect for > > the DB you're using? > > > > I think I've found the problem. I was over-quoting at process() time, and not doing enough > translation at display time. Looks like DataObject quotes slashes already, by itself. Of course it does. DB_DataObject would be useless if it didn't know how to escape data to go into the DB (BTW, the thing that actually does the escaping is DB::quoteSmart). DB_DataObject will also quote table and field names if you ask it to (quote_identifiers option). > > To display the CR/LF's, I'm using nl2br(htmlspecialchars($value)) on frozen data, and > not doing any translation at all on editable data that goes into textboxes, and this is working well > so far. > Translation should only be done right when it's needed. For data going into the DB it should be only escaped (no htmlentities, etc.). For data output to the browser, unless it's expected to have HTML, htmlentities should be run on it. But only when it's output, not when it's saved. -- Justin Patrin