Mysql Real Escape String PHP Function Adding "\" to My Field Entry

Question

I am submitting a form to my MySQL database using PHP.

I am sending the form data through the mysql_real_escape_string($content) function.

When the entry shows up in my database (checking in phpMyAdmin) all of my double quotes and single quotes are escaped.

I'm fairly certain this is a PHP configuration issue?

so:

$content = 'Hi, my name is Jascha and my "favorite" thing to do is sleep';
mysql_real_escape_string($content);
$query = 'INSERT INTO DB...'

comes up in my database as:

Hi, my name is Jascha and my \"favorite" thing to do is sleep

Who do I tell what to do? (I cannot access the php.ini).

Answer 1

If you are getting your $content data from a form (and not "as-is" in the PHP code), maybe you're having a problem because of Magic quotes (see magic_quotes_gpc)

Basically :

When magic_quotes are on, all ' (single-quote), " (double quote), \ (backslash) and NUL's are escaped with a backslash automatically

If magic quotes are enabled (you can check this in the ouput of phpinfo(), for instance), you'll be getting that kind of "double escaping" :

• Those characters will be escaped once by magic quotes,
• And, then, they'll be escaped a second time by mysql_real_escape_string

The good solution, in this case, is not to stop using mysql_real_escape_string, but to disabled magic_quotes_gpc in your configuration...

... But, as you don't have access to it, you'll actually have to "revert" the effect of magic quotes, calling stripslashes on the input you're getting as $_GET and $_POST, before begining using it.

Note : it's an advice that's given on the manual page of mysql_real_escape_string (quoting) :

Note: If magic_quotes_gpc is enabled, first apply stripslashes() to the data. Using this function on data which has already been escaped will escape the data twice.

Answer 2

You need to take magic quotes into account when retrieving request data. If get_magic_quotes_gpc() is true, then you need to run stripslashes() on the input. Best way would be to write a function for that. Something like:

function get_string($array, $index, $default = null) {
    if (isset($array[$index]) && strlen($value = trim($array[$index])) > 0) {
        return get_magic_quotes_gpc() ? stripslashes($value) : $value;
    } else {
        return $default;
    }
}

..which you can use as

$input = get_string($_POST, 'input');

..instead of

$input = $_POST['input'];

Do the same for trivial stuff like get_number(), get_boolean(), get_array() and so on.