escaping variable

[jackvull]

I am using addslashes to escape apostrophes in strings.
I know this works correctly because the input field is inserted into the database with the apostrophe in the correct place.
However, I am also validating a form, so when other parts of the form are not correct it returns all fields that the user has entered so far.
For some reason, the field with the apostrophe is cut short.
So with a name like O'Brien, I do this:
$lastname = addslashes($_POST['lastname']);
echo $lastname;

Correctly echo'd as O\'Brien

However, the form:
echo "
<td style='color:red; font-weight: bold;'>*** Last Name: ***<br/><input type='text' name='lastname' tabindex='7' value ='".$lastname."' style='background-color:#FFFF99; width:100%;'> ";

just displays O\

Any ideas why?
Thanks

[henry0]

This:
<?
$lastname = htmlentities ($_POST['lastname']);
echo $lastname;
?>

results in:
o\'brian

[jackvull]

Doesn't seem to.
It's not that part that's causing the problem.
It's when I put the variable back into an input box.
For example the variable is:
$lastname = O\'Brien;

When I put
blah blah value = '".$lastname."'

It's get to the apostrophe and stops s the input box only has
O\ in it

[henry0]

What do you mean by
<<<
It's when I put the variable back into an input box.
For example the variable is:
>>>
Back from a DB?
Or back for another reason such a missing field or unauthorized characters?

BTW
addslahes generates 3 slashes
the other version only generates 1- I tested it-

[jackvull]

Well, they way it's done in this script is:
1. User puts ni a variable into the input box and submits it (POST);
2. The posted variable is escaped by addslashes() and any other dodgy characters removed like ;
3. The information is validated and if there's nothing wrong with the information, it is put directly into the DB. Testing has confirmed that it is put in as O'Brien.
4. If there was something wrong with any of the other data, the script doesn't get as far as the SQL query and reloads the page highlighting the input box that needs to be corrected by filling it with the posted (and escaped) variable. All other input boxes are also automatically refilled. Except, in this instance this input box is returned as O\ instead of O'Brien

I know it's escaped correctly as the SQL query works but somehow the apostrophe is messing up the string when I try to put it back into an input box.

[henry0]

If in your DB the input reads (when looking at it directly from the DB, not via a query; for ex: in phpMyAdmin in browse mode) O'Brien
Then the problem could be related to the querry that brings it back.
How does it look?

[jackvull]

Sorry, I didn't explain that well previously.
For example, I have 2 input boxes (firstname & lastname)
Input box 1:John
Input Box 2:O'Brien

These are submitted (POST) and validated.
In the example above they are fine and are put in the database. With browse they appear as John O'Brien
i.e. with apostrophe correctly.

No data is actually retrieved from the database ever.
So what happens is, for example
Input box 1:J
Input Box 2:O'Brien

This is submitted (POST) and validated. My script sees that Input box 1 is less than 2 characters long so instead of inserting the data it just brings up a message highlighting input box 1.
For user friendly stuff, I fill in input box 2 for them automatically. So, it's supposed to read O'Brien except it only reads O\

So, howcome if the form was all fine, the database entry works fine, but the default value for the input box stops at O\?

I checked the variable just before it is echod for the input box and it display O\Brien.
Thefore the bit where I put <input blah blah value='".$lastname."'

Something in that stops as soon as it gets to the apostrophe

[henry0]

If it is not coming back from the DB you are echoing data post ()
Therefore it stops at the “ ‘ “
Out of curiosity try (for test only) to rem the () it should read it correctly.

You could after checking data such as passing through your regex and if isset and!empty
Use the post value to create a session then exit() if check does not pass.
Pass it back to the form and unset and destroy it
Now the value is preserved but only if data is OK.

When all users’ inputs are OK write to your DB.
And for edit purpose if needed use another set of form

[adni18]

it's because you specified the attribute value with single quotes ( value='' ). just make it value=\"".$lastname."\" and all will be well :) (except if the person enters a ", which will be bad).

Ex. <input type='text' value='O'brien'> now what kind of browser would like that? :P

[willybfriendly]

The single quote might be a problem, but I would think one would need to use stripslashes() before echoing the data back into a form field.

echo "
<td style='color:red; font-weight: bold;'>*** Last Name: ***<br/><input type='text' name='lastname' tabindex='7' value ='".stripslashes($lastname)."' style='background-color:#FFFF99; width:100%;'> ";