Escaping raw HTML data inserted into MySQL

Question

<table width="100%" cellspacing="1" cellpadding="0" border="1">
<tbody>
    <tr>
        <td height="30" bgcolor="#006699" align="center" class="heading" colspan="6" style="color:#fff; font-size:22px;">hello this is test</td>
    </tr>

<table width="\\100%\\" cellspacing=\\"1\\" cellpadding=\\"0\\" border=\\"1\\">
<tbody>
    <tr>
        <td height=\\"30\\" bgcolor=\\"#006699\\" align=\\"center\\" style=\\"color:#fff; font-size:22px;\\" colspan=\\"3\\" class=\\"heading\\">hello this is test </td>
    </tr></tbody></table>

Is it possible that i can just remove the backslashes, from this?

and how are these backslashes coming? – user2936213 Jan 29 '14 at 12:55 — user2936213, Jan 29 '14 at 12:55
@user2936213 That's what he's asking. – Styphon Jan 29 '14 at 12:59 — Styphon, Jan 29 '14 at 12:59

score 1 · Accepted Answer · edited May 23 '17 at 12:28

1

Your server has Magic Quotes enabled. You can contact your host and ask them to disable it, or before you send the data to your query you can use stripslashes() on it. See this answer for more info.

edited May 23 '17 at 12:28

Community

1
1

answered Jan 29 '14 at 12:56

Styphon

10,304
9
52
86

score 0 · Answer 2 · answered Jan 29 '14 at 13:02

In your host probably has magic_quotes_runtime turned on. You can turn it off with set_magic_quotes_runtime(0).

Please turn off magic_quotes_runtime, and then change your code to use bind variables, rather than using the string escaping If you are using mysql_real_escape_string .

To make sure there are no slashes in that value, you can apply

echo "Magic quotes is " . (get_magic_quotes_gpc() ? "ON" : "OFF");

Or you can perform a .htaccess edit to turn off magic_quotes, add the following line in your .htaccess file

php_flag magic_quotes off

Escaping raw HTML data inserted into MySQL

2 Answers2