php automatically adds slashes to quotes

Question

All I'm trying to do is to get xml file content, show is in the textarea and update the file content if the for is submited. I use this code:

$fname = "../data.xml";

if (isset($_POST["update"])) {
 $content = $_POST["update"];
 $fhandle = fopen($fname,"w");
 fwrite($fhandle,$content);
}

$fhandle = fopen($fname,"r");
$content = fread($fhandle,filesize($fname));

fclose($fhandle);

The content is updated when I press submit but it adds slashes to quotes. For example this code:

<?xml version="1.0" encoding="utf-8"?>

becomes:

<?xml version=\"1.0\" encoding=\"utf-8\"?>

and if I re-submit:

<?xml version=\\"1.0\\" encoding=\\"utf-8\\"?>

Can anyone please tell what am I doing wrong?

Thanks in advance

score 11 · Answer 1 · answered Jan 17 '11 at 17:01

11

This is probably due to Magic Quotes. Try to disable or remove them.

answered Jan 17 '11 at 17:01

Gumbo

643,351
109
780
844

score 10 · Accepted Answer · answered Jan 17 '11 at 17:02

10

This is an issue with Magic Quotes, we ran into it as well. Use stripslashes() on the POST input before doing anything with it.

answered Jan 17 '11 at 17:02

mrbellek

2,300
16
20

This is nothing to do with "UNIX" and everything to do with magic quotes being enabled on the server. – John Parker Jan 17 '11 at 17:02
Daaaaang. I hate Magic Quotes now, I've spent quite a few hours trying to see what my issue was. I thought it was the encoding.. – PaulBGD Nov 05 '13 at 02:37
1

This is not the case for me. All is off but still happening. :/ – JamesG Jun 20 '17 at 14:31

score 2 · Answer 3 · answered Jan 17 '11 at 17:02

2

Disable magic_quotes_gpc from php.ini.

answered Jan 17 '11 at 17:02

Ciprian L.

587
2
7

score 2 · Answer 4 · answered Jan 17 '11 at 17:11

Magic Quotes should always be disabled; it's a security risk. If you can't edit the config, or if you putting the code on multiple servers with different settings that can't be changed, you need the code to check for it. This example was found here --> http://php.robm.me.uk/#toc-MagicQuotes

function remove_magic_quotes($array) {
    foreach ($array as $k => $v) {
        if (is_array($v)) {
            $array[$k] = remove_magic_quotes($v);
        } else {
            $array[$k] = stripslashes($v);
        }
    }
    return $array;
}
if (get_magic_quotes_gpc()) {
    $_GET    = remove_magic_quotes($_GET);
    $_POST   = remove_magic_quotes($_POST);
    $_COOKIE = remove_magic_quotes($_COOKIE);
}

score 1 · Answer 5 · answered Dec 19 '11 at 22:05

1

You can also disable magic quotes by adding this line to your .htaccess file:

php_flag magic_quotes_gpc Off

answered Dec 19 '11 at 22:05

Kevin C.

2,499
1
27
41

score 0 · Answer 6 · answered Jan 17 '11 at 17:02

0

Take a look at stripslashes()

answered Jan 17 '11 at 17:02

Nilks

446
4
14

php automatically adds slashes to quotes

6 Answers6

Linked