mysql_real_escape_string ?

Discussion in 'PHP' started by stats, Mar 14, 2008.

0
  1. #1
    how do i recover the string after i get it back from DB ?

    say .. the string is a javascript or something which may contain all possible dangerous characters like " , ', `, \, /, etc. So i should do a mysql_real_escape_string($string) before inserting to DB.

    now, at the second part i wanna retrive it from DB .. if i do stripslashes on it, it may mess it up .. right ?

    so what would be the correct way to do this ?

    Thanks
     
    stats, Mar 14, 2008 IP
  2. liam1412

    liam1412 Active Member

    Messages:
    387
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    60
    #2
    As i understand it stripslashes will only remove the slashes that were added by mysql_real_escape_string so it should just work fine.
     
    liam1412, Mar 15, 2008 IP
  3. Gordaen

    Gordaen Peon

    Messages:
    277
    Likes Received:
    12
    Best Answers:
    0
    Trophy Points:
    0
    #3
    You do not need to worry about when you are pulling data out. If your query inserts He says, "I don't want to!" then mysql_real_escape_string() makes it He says, \"I don\'t want to!\" (which makes it safe to send to the DB. The extra slashes are NOT stored in the database. When you pull the data, you'll end up with He says, "I don't want to!" again.
     
    Gordaen, Mar 15, 2008 IP