PHP addslashes not working as expected if a string starts with numbers and contains a quotation mark

Question

I have a form with a textbox 'size_txt' which stores a string representing a size choice.

<input type="text" name="size_txt" id="size_txt" style="display: none;" />

The value is posted to another page and retrieved by this code

$new_size=addslashes($_POST['size_txt']);

Unfortunately it needs to store the abbreviation of inches which is " quotation mark

if the string is '10" medium' then the value of $new_size is '10'

However if the string is 'medium 10"' then the value of $new_size is 'medium 10/"'

Has anyone else come across this behaviour and worked out how it could it be resolved?

Thanks for any help

the result of `addslashes('10" medium')` should be `10\" medium` — Jason OOO, Sep 21 '13 at 20:40
Why exactly are you adding slashes there? I hope it is not for storing something in database. — tereško, Sep 21 '13 at 20:44
It's just test code at the moment, I'm planning on using mysql_real_escape_string() to get around any sql injection issues or PDO when it's ready for MySql — David Caldwell, Sep 21 '13 at 20:55

score 3 · Accepted Answer · answered Sep 21 '13 at 20:46

3

Yes the issue is there.

Note that when using addslashes() on a string that includes cyrillic characters, addslashes() totally mixes up the string, rendering it unusable.

No of solution's

1) use mysql_real_escape_string instead of addslashes

2) try below code like str_replace

$myString = str_replace("'", "\'", $myString);
$myString = str_replace('"', "'+String.fromCharCode(34)+'", $myString);

if you have stil issue just let me know.

Regards

answered Sep 21 '13 at 20:46

Jigar Chaudhary

Thanks Jigar, thank you for your explanation and solution which worked as well – David Caldwell Sep 21 '13 at 21:04

score 0 · Answer 2 · answered Sep 21 '13 at 20:42

0

For your usecase you may be better off just using htmlspecialchars() to escape the "

answered Sep 21 '13 at 20:42

Chase

Thanks You :) htmlspecialchars() worked and I'm now getting '10\" medium', I still can't work out why addslashes() didn't like my code but at least I can move on now. – David Caldwell Sep 21 '13 at 20:48

2 Answers2