addslashes

Example 1186. Prepare a string for use in a MySQL query

<?php
// Database connection code omitted for brevity
// ...

// Pretend that $HTTP_POST_VARS['comment'] came from a user posting a form
$HTTP_POST_VARS['comment'] = "Why haven't you updated your site for 2 months?";

// Insert data straight from a form into a database
// Suppress any errors that are generated
$query = "INSERT INTO user (comment) VALUES '$HTTP_POST_VARS[comment]'";
$query_handle = @ mysql_query($query);

if (mysql_errno())
    echo 'MySQL did not like the query! It returned the following error:<br /><i>'
    . mysql_error() . '</i><br /><br />';

echo <<<HEREDOC
   <b>Here is what went wrong:</b><br />
   \$HTTP_POST_VARS['comment'] contained: "<i>$HTTP_POST_VARS[comment]</i>".<br />
   We built a query with it that looked like: "<i>$query</i>"<br />
   The single quote (') that already existed in the string caused the single
   quotes used to delimit the value for the <i>comment</i> field to end prematurely,
   giving us a syntax error in our query.<br /><br />
HEREDOC;


// Here is a better way to do it.

// Clean user input from an HTML form
// Remove trailing and leading whitespace with trim()
// ...then escape quotes, null bytes, and backslashes with addslashes()
$clean_data = addslashes(trim($HTTP_POST_VARS['comment']))
    or die("Please fill out the <i>Comments</i> field.");

// Insert data into database
$query = "INSERT INTO user (comment) VALUES '$clean_data'";
$query_handle = @ mysql_query($query);

echo <<<HEREDOC
   <b>Here is what we did to fix it:</b><br />
   We passed the form data to addslashes(), which converted them to: "<i>$clean_data</i>"<br />
   We then built a query with the cleaned data that looked like this: "<i>$query</i>"<br />

   See how the single quote (') that already existed in the string is escaped - this prevented
   the single quotes used to delimit the value for the <i>comment</i> field from ending prematurely.
   <br /><br />
HEREDOC;
?>

Example 1187. Show how addslashes() transforms a string

<?php
echo "Before addslashes():\n";
echo $quote = <<<QUOTE
 "We all felt the majesty of the body...
  As we saw the artificial heart beat...
  the feeling was not aren't we great,
  but aren't we small."
              --- Dr William C DeVries\0\n\n
QUOTE;

echo "After addslashes():\n";
echo $cleaned_quote = addslashes($quote);
?>

Output:
Before addslashes():
 "We all felt the majesty of the body...
  As we saw the artificial heart beat...
  the feeling was not aren't we great,
  but aren't we small."
              --- Dr William C DeVries

After addslashes():
 \"We all felt the majesty of the body...
  As we saw the artificial heart beat...
  the feeling was not aren\'t we great,
  but aren\'t we small.\"
              --- Dr William C DeVries\0