Description
string addslashes (string str)
Returns a string with backslashes before characters that need
to be quoted in database queries etc. These characters are
single quote ('), double quote
("), backslash (\)
and NUL (the null byte).
See also stripslashes(),
htmlspecialchars(), and
quotemeta().
| User Contributed Notes: AddSlashes |
info@bokelberg.de
10-Sep-1999 05:37 |
Using an oracle database addslashes
doesn`t work to escape single quotes.
You have to double the single quote
instead. Here is an example using
ereg_replace:
$escaped_string = ereg_replace("'","''",$string_with_single_quotes);
|
|
brian@vividnet.com
29-Sep-1999 03:10 |
Addslashes operates in 2 modes, either escape ' with Sybase method '' or the MySQL/rest \' method. I quickly ran into problems when I have both MySQL, and Openlink ODBC-> MS SQL 7.0 in use. An optional parameter to force Sybase style quoting would be nice.
|
|
bruce.j.cadiz@boeing.com
19-Nov-1999 09:22 |
In ref. to note stating
"Using an oracle database addslashes doesn`t work to escape single quotes."
This is not successful when passed to ora_parse():
http://www.php.net/manual/function.ora-parse.php3 Another way to deal with this problem is to use stripslashes():
http://www.php.net/manual/function.stripslashes.php3
function. PHP will try to "escape" single quotes on name
value pairs (POST or GET) example: A query string is passed with single quotes like
(SELECT * FROM EMP WHERE EMPNAME = 'SMITH')
will be changed to
(SELECT * FROM EMP WHERE EMPNAME =\'SMITH\')
stripslashes():
http://www.php.net/manual/function.stripslashes.php3
will fix this.
(ora_parse($curs,stripslashes($query)));
|
|
flybird123@sina.com
26-Apr-2000 04:28 |
addslash can quote binary data from a database. Form example
$result = mysql_query("SELECT * FROM sendbuf where flagsend = 0 ",$connin);
while ($myrow =
mysql_fetch_array($result))
{
$pic1_data = addslashes($myrow ["pic1_data"]) ;
}
|
|
Aaron.Cameron@cityvu.com
28-Jul-2000 01:43 |
Php doesn't strip the slashes when info comes out of the database. The difference here is that php4 automatically adds slashes to incomming variables (from a post/get) and php3 didn't. So if you're adding slashes manually, suddenly you have double. Either drop your second addslashes() or add a stripslashes to the beginning to all the variables that come in.
|
|
leingang@math.harvard.edu
08-Aug-2000 10:16 |
Not sure if this is the right place to put this, but...adding slashes will not work to escape quotes in the VALUE field of hidden elements! Instead, use urlencode() and urldecode().
|
|
Manuel@Hossfeld.de
11-Aug-2000 01:19 |
Also this may seem like trivial advice...:
It's really important where to use addslashes() !
$str = "c:trickybackslashespath";
echo addslashes($str);
...won't escape the t at the beginning, effectively outputting
c: ricky\backslashes\path
because you already assigned the string containing a TAB _before_ using addslashes...!
Correctly, the above should rather be
$str = addslashes("c:trickybackslashespath");
echo $str;
An alternative to this would be the usage of single quotes. Read the comment in the main string-functions section for more info on this.
|
|
jlp
16-Aug-2000 05:54 |
note that the escaping style used by addslashes depends on the configuration variable magic_quotes_sybase-- even if magic_quotes_gpc and magic_quotes_runtime are disabled.
eg:
$string="foo\\bar'baz\"quux";
ini_alter("magic_quotes_sybase",0);
$string1=addslashes($string);
ini_alter("magic_quotes_sybase",1);
$string2=addslashes($string);
print("string1: $string1
");
print("string2: $string2
");
outputs:
string1: foo\\bar\'baz\"quux
string2: foo\bar''baz"quux
|
|
se@brainbits.net
28-Sep-2000 06:32 |
The problem with the automatically added slashes is not a php4 or php 3.0.xx and higher problem. PHP automatically adds slashes when the "magic_quotes" are enabled in the php.ini !!!
|
|
nightowl@uk2.net
12-Dec-2000 09:31 |
If you want to import the exported file into Access, you also need to dubble the "'s .
I used
$write = ereg_replace("\"","\"\"",$original_text);
|
|
spamdunk@home.com
06-Mar-2001 01:12 |
FYI, Quoting the single quote (') as ('') is not an Oracle stle, or a Sybase style, or any other vendor-specific style. It is the ANSI SQL (i.e. SQL standard) style.
Using blackslahes to escape characters is a proprietary extension that some databases have. If you want your SQL to be portable across databases, don't use it.
For example (on PostgreSQL):
=> create table t (s varchar(64));
CREATE
=> insert into t values ('one''two"three''');
INSERT 206474 1
wapkey=> select * from t;
s
----------------
one'two"three'
(1 row)
... as expected, as per the standard.
|
|
php@NO_SPAMj-w3.com
02-Apr-2001 03:18 |
as mentioned php4 automatically adds slashes to post and get and these slashes aren't in the database. BUT be careful of this. If you have a form with an error check, make sure you strip the slashes if your form remembers the OK fields.
|
|
AddCSlashes