0

Silly question, but can't think of the answer, ive used addslashes and removeslashes for adding data into my mysql, but when retrieving it also removes just normal \ that were not generated by the function, is there a better way to do this without using str_replace?

5
  • Why don't you want to use str_replace()?
    – RobinJ
    Nov 6, 2011 at 17:53
  • 4
    Yes, by not using addslashes() nor stripslashes() but mysql_real_escape_string() to insert data into database Nov 6, 2011 at 17:53
  • @RobinJ because that will add extra code Nov 6, 2011 at 17:54
  • 2
    so i would just replace addslashes by mysql_real_escape_string() and wouldnt need to use removeslashes at all? Nov 6, 2011 at 17:56
  • @SauliusAntanavicius: Exactly.
    – hakre
    Nov 6, 2011 at 17:58

2 Answers 2

2

To pass arguments to a database there's mysql_real_escape_string() for mysql_* and mysqli_*, and bindParam for PDO. Also, when you put this in an SQL Query for example: Hello\/World, only Hello/World will be passed into the database, not the \ wich was used to escape the /.

PDO->bindParam() http://php.net/manual/en/pdostatement.bindparam.php mysql_real_escape_string(): http://php.net/manual/en/function.mysql-real-escape-string.php

1
  • 2
    To extend on this answer.... mysql_real_escape_string will add the slashes for you. When you retrieve the data from the DB, you don't need to call stripslashes because the slashes never made it into the DB; they're just there so that the value gets inserted correctly.
    – mpen
    Nov 6, 2011 at 17:57
-1

The backslash escapes are used to make strings valid to pass by the SQL parser. The database will not store those backslashes. When you query the database again, they will not be returned.

And btw, the correct escaping for What'ever is not 'What\'ever' but 'What''ever'. Using addslashes() on input strings only works if your MySQL server is in backwards-compliant mode.

2
  • No, MySQL's escaping sequence has always been a backslace. doubled single-quotes is only valid if ANSI QUOTES mode is enabled: dev.mysql.com/doc/refman/5.0/en/string-syntax.html
    – Marc B
    Nov 6, 2011 at 18:03
  • 2
    You're screwing my scare tactics with your damn superfluous facts!
    – mario
    Nov 6, 2011 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.