PHP Addslashes adding double backslashes when escaping a single quote [closed]

Question

Addslashes seems to be a bit confused. Given the following 2 lines of code

$name = "Dave's test";
$newName = addslashes($name);

I am expecting $newName to be "Dave\'s test" (my one single quote nicely escaped)

However, what I'm getting is "Dave\\'s test" (note the DOUBLE backslashes). This contradicts every bit of online documentation I can find on addslashes - and causing me a lot of grief.

I am dumping the before and after addslashes results to the http error log via error_log...

error_log("before=$name  after=$newName");

results...

before=Dave's test  after=Dave\\'s test

Note - this is part of an ajax process, so I can't really 'echo' the results.

Any insights into why addslashes would be double up on the backslases are much appreciated.

FYI: I'm Using PHP 5.2.6 under linux with magic quotes OFF.

Answer 1

Looks like error_log is calling addslashes internally. After reading the questions posted in reponse to my original question, I created a very trivial script...

<?php
        $name = "Dave's test";
        $newName = addslashes($name);
        echo    "name=$name.   newName=$newName";
        error_log("name=$name.   newName=$newName");
?>

Result from the echo:

name=Dave's test. newName=Dave\'s test

Result from the error_log:

name=Dave's test.   newName=Dave\\'s test

Many thanks to all who took the time to read and comment on this question. This was my first question on Stack Overflow and I was just blown away by the speed of the responses. What a great community!

Answer 2

For starters, why are you escaping with addslashes()? It's an insufficient method at best, especially if you're trying to guard against SQL injection.

What else can you tell us about your configuration so we can try and replicate?

Answer 3

You can set magic_quotes_gpc to Off in your php.ini file. That will stop your double escaping. Remember to do this with caution as if you are using SQL in anyway you're opening yourself up to some easy SQL injections.