0

Can I loop through DB results and remove Slashes?

(I started getting more slashes everytime I edited the text and put it back into the DB)

$db = new connection();

$query = "SELECT * FROM ITEMS, ALPACA_SALES WHERE ITEMS.uid = '$id' AND ALPACA_SALES.uid = ITEMS.uid";
$results = $db->query($query);

$data = array();    
while($info = mysql_fetch_array($results))
{
    $data[] = stripslashes($info);
}

But I am getting the following error:

Notice: Array to string conversion in /home/content/myfile.php  on line 78

When I add the data to the database I do the following:

if (!empty($_POST['more_text']))
{
    $more_text = addslashes($_POST['more_text']); 
}
else
{
    $error = false;
    $error_message = "Please add a description.";
}

And then I use UPDATE for the insert into the DB:

$query2 = "UPDATE ALPACA_SALES SET more_text = '$more_text' WHERE uid = '$id'"; 

$result = $db->query($query2);
2
  • We need to see your insert query. There is a problem with it Apr 23, 2011 at 4:13
  • See my edit above for the updating the DB
    – Denoteone
    Apr 23, 2011 at 4:25

2 Answers 2

2

You can't run stripslashes() on an array, which is what $info is from storing mysql_fetch_array($results). You could iterate through $info and strip slashes on each entry, or explicitly strip slashes if you don't need to do all of them.

$i=0;
while($infoarray = mysql_fetch_assoc($results))
    {
        foreach($infoarray as $field=>$value){
            $data[$i][$field] = stripslashes($value);
        }
        $i++;
    }

Edit: You can also create a small function to strip slashes in an array, as outlined in the documentation here: http://us.php.net/manual/en/function.stripslashes.php

function stripslashes_deep($value)
{
    $value = is_array($value) ?
                array_map('stripslashes_deep', $value) :
                stripslashes($value);

    return $value;
}

// Example
$array = array("f\\'oo", "b\\'ar", array("fo\\'o", "b\\'ar"));
$array = stripslashes_deep($array);
3
  • When I use the code above and then try to echo the values like so: <? echo $data[0]['more_text']; ?> I get the number 1 and to test I echo $field but get 7more_text Sorry if I am not grasping this but I appreciate your help.
    – Denoteone
    Apr 23, 2011 at 4:55
  • I made a few changes. I had forgotten to increment where we're storing things in $data with each row. I also changed it to mysql_fetch_assoc so we get the proper key=>value pairs. I would suggest adding a print_r($infoarray) at the beginning of the where loop and a print_r($data) after it finishes to see how things are structured and to better troubleshoot.
    – Brian
    Apr 23, 2011 at 5:07
  • Thanks again for your help and I will remember the print_r for testing.
    – Denoteone
    Apr 23, 2011 at 5:12
1

Do not do that. stripslashes() is not enough to make a string safe to use in an SQL statement. Your code is vulnerable to SQL injection. Use prepared statements and bound parameters instead.

1
  • Thanks for the recommendation. This form is in an admin area so I hadn't though to much about security. I was just getting weird results from the quotes and apostrophes.
    – Denoteone
    Apr 23, 2011 at 4:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.