Sql Injection OK, Frontend now shows slashes

How can I get rid of the slashes?

[asantos]

I implemented this code to bypass any kind of sql injections:

//Retrieve the data for textareas and inputs
//******************************************
function qd($data) {
$data = stripslashes($data);
return htmlentities($data,ENT_QUOTES);
}

//For SQL queries
//*******************************
function q($data,$string=false) {
if(get_magic_quotes_gpc()) {
$data = stripslashes($data);
}
$data = mysql_real_escape_string($data);
if ($string) { $data = "'".$data."'"; }
return $data;
}

//Used when saving
//****************
function s($data,$max,$type=false) {
switch($type) {
case 'html': $data = strip_tags($data,'<p>,<br>,<img>,<a>,<strong>,<em>,<blockquote>,<ol>,<ul>,<li>,<span>'); break;
case 'php': break;
default: $data = strip_tags($data);
}
$data = q($data);
return substr($data,0,$max);
}

Everything works just fine! The problem is that now my frontend shows data with slashes.

For example:
O'Relly shows O\'Relly

I know i could implement some kind off stripslashes() in the frontend too, but that would be too mucho work. Any ideas?

[eelixduppy]

>>but that would be too mucho work
Using one function? Why don't you want to use stripslashes [us3.php.net]? Seems like a logical choice to me.

[edited by: jatar_k at 3:11 am (utc) on June 6, 2006]
[edit reason] fixed link [/edit]

[asantos]

Actually I have a form-class that prints all forms. Inside of it ive placed the qd() function for the proper loading of control values, so there's no such 'too much work' ;)

I've commented the q() stuff in the s() function. It works fine now.

[eelixduppy]

I'm glad you got it working now. Just make sure however, since you took out q() from s(), that your query is being escaped properly with mysql_real_escape_string. You don't want to have any problems. ;)