Magic quote headache

could use a little guidance...

[danielNorge]

Hi.

I’m admittedly new to php, but was hoping someone could clarify what appears to be a magic quote issue I’m having. I’m attempting to $_post a query to a ‘export to excel’ page, but my query is escaping at the first set of double quotes. Example:

Php_page1->

$query = ‘SELECT * FROM table WHERE first = "something" AND second = “else"’;

<FORM ACTION="exportToExcel.php" METHOD=POST>
<input type="hidden" name="query" value="<?php echo ($query);?>">
<input type="submit" value="Export to Excel">
</form>

Php_page2 exportToExcel.php->

If I do an echo here, yes, you guessed it, my query is now truncated to: SELECT * FROM table WHERE first =

I’ve checked, and Magic quotes gpc is off. Anyone willing to tell me how to get my whole query (including quotes) to page 2? I’m not sure if this is a security issue, but it will only be used in a work environment, so not really worried about hackers (would be nice to know how to do it the ‘right’ way, though =)

p.s. there’s a good tutorial for exporting to excel here…
[phpfreaks.com...]

[dreamcatcher]

Hi,

Try using apostrophes and removing the double quotes. Like this:

$query = "SELECT * FROM table WHERE first = 'something' AND second = 'else'";

dc

[NomikOS]

Try replace $query inside hidden input like this:
<input type="hidden" name="query" value=" (replace here) ">

You obtain this:

<FORM ACTION="exportToExcel.php" METHOD=POST>
<input type="hidden" name="query" value="‘SELECT * FROM table WHERE first =" something" AND second = “else"’">
<input type="submit" value="Export to Excel">
</form>

(something" AND second = “else"') is outside from value of variable query.
Very bad. That's why your problem.

--------------------------------

if magic_quotes_gpc are off (good for security) then you must use addslashes() on each $_POST variable before write your sql code.

on PHP do this:
$query = "SELECT * FROM table WHERE first = 'something' AND second = 'else'"; // see quotes
$querySafe = addslashes($query);

note1: in PHP is better write sql queries between double quotes (") for parse vars inside. not use: ‘SELECT * FROM table WHERE first = "something" AND second = “else"’; // see quotes

on HTML do this:
<input type="hidden" name="query" value="<?php echo safeOut($query);?>">

function safeOut($string)
{
return htmlspecialchars($string, ENT_QUOTES);
}

note2: use get_magic_quotes_gpc() for be secure about magic_quotes_gpc value inside scripts.
note3: you must always consider magic_quotes_gpc, addslashes, htmlspecialchars in your PHP/SQL code
note4: write all HTML code with double quotes.

note1, note3 and note4 give your solution.

search get_magic_quotes_gpc site:php.net

please tell me if this answer your question.--

[danielNorge]

Thanks for the input!

Dreamcatcher, with a little bit of fiddling, your solution worked. Switching out the double quotes allowed the $_post to work properly, but I had to do a str_replace to switch them back for BinaryStar's excel export script to function.

I'm sure it's possible to re-write the export code to avoid the str_replace, but I'm just happy it's finally doing what I expect!

NomikOS, thanks for the good tips! I appreciate you taking the time to help clarify the magic quote mystery =)

Cheers!

[dreamcatcher]

You`re welcome, glad we could give you some guidance.

dc

[ergophobe]

I know I'm late to the party and you have it sorted, but you might like to have a look at

[webmasterworld.com...]

especially coopster's enlightening messages

[NomikOS]

yes cheers
regards.-

[coopster]

You may also want to review the comments regarding magic quotes in the PHP Security [webmasterworld.com] thread though, too. I am no longer lazy ;)