0

For some reason addslashes is NOT adding slashes when inserting data into database. I thought I was using this right, but clearly not... When I submit data that has single or double quotes, it is just sending the exact string right in. Any ideas on how to make this work?

The code

<?php
//include db connect
  include ("db_con.php");

//start session
  session_start();

//set variable names
  $username = $_SESSION['username'];
  $entry = addslashes($_POST['entry']);
  $uri = $_SERVER['HTTP_REFERER'];

//send chat
  $query = mysqli_query($con, "INSERT INTO chat (username, entry) VALUES
                                                ('".$username."', '".$entry."')"); 
  if ($query) {
    header('Location: '. $uri);
  } else {
    echo 'Chat entry failed for an unknown reason - Please go back and try again';
  }
?>
2
  • addslashes is not the correct function for escaping data when entering into databases, as its manual page clearly states. The correct function in this case is mysqli_real_escape_string.
    – IMSoP
    Mar 11, 2014 at 22:41
  • addslashes is about as useful for protection against sql injection attacks as wet toilet paper is as a rope. Try to forget the function even exists and NEVER use it for anything.
    – Marc B
    Mar 11, 2014 at 22:46

2 Answers 2

2

addslashes() is for escaping the string. If you got code:

$lastname = "O'Bama";

$query = "SELECT name FROM users WHERE lastname='$lastname'";

The query will produce an error because Bama will be treated as SQL statement. To prevent this you can use addslashes() so

echo addslashes($lastname); // returns O\'Bama

Now you can execute your query without any errors because your database will see value as "O'Bama".

5
  • So you are saying that addslashes() may be doing it's job, however it still will insert it into the database with the quotes? or am I totally misunderstanding you?
    – doriansm
    Mar 11, 2014 at 22:38
  • 1
    It will insert quotes because you are escaping them and they are not treated as part of SQL query but part of your value.
    – barell
    Mar 11, 2014 at 22:38
  • Ok so this should help secure against SQL injections correct? Sorry for the newby questions, I am still a PHP/MySQL beginner.
    – doriansm
    Mar 11, 2014 at 22:40
  • 1
    Correction, addslashes is not for doing anything with databases. The correct function in this case is mysqli_real_escape_string.
    – IMSoP
    Mar 11, 2014 at 22:40
  • @Aldentec No, this is not nearly enough to prevent SQL injection. For proper security you should use PDO with parameterized queries: php.net/manual/en/ref.pdo-mysql.php or MySQLi: php.net/manual/en/book.mysqli.php
    – siva.k
    Mar 11, 2014 at 22:42
1

Using addslashes() when dealing with databases is very bad practice. Since you're using PHP's mysqli extension, you should escape your data with mysqli_real_escape_string(). The PHP manual page for addslashes() explains why.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.