Slash and Quotes or Apostrophe

php script slash quote

[us2000]

I have a problem with a simple PHP script. When my photos on my website are described anytime there is a double quote (") or apostrophe (') there is a back slash in the description. I have reviewed several sites and forums but can't seem to find a match to my specific problem. Here is the snippet I use for the photo description from the PHP generated destination page.

<font size="2" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular" color="black"><b><? echo $desc;?></b></font>

Orgin example:

instinct07.php4?page=003&desc=J.P. Calderon ( L ) from "Survivor: Cook Islands" with Ross Matthews from "The Tonight Show with Jay Leno" and Carey Sherrel( R ) from "The Apprentice Season 6".

Turns out to be this:
J.P. Calderon ( L ) from \"Survivor: Cook Islands\" with Ross Matthews from \"The Tonight Show with Jay Leno\" and Carey Sherrel ( R ) from \"The Apprentice Season 6\".

This basically places a description below a photograph.

Any ideas on how to get rid of the \

[gergoe]

See the php manual about magic_quotes [php.net] in general, and the manual of strip_slashes [php.net] on how to get rid of the slashes.

[us2000]

Thank you for your reply. I read over the two links which you supplied but I am not sure where I put the sting. Do I put them in the orgin or the destination coding?

[gergoe]

If magic_quotes are enabled on the server (as it seems to be), then all values coming from the browser will be escaped with slashes (where it applies). When you read such a value in your php script (with $_GET, $_POST or $_REQUEST), then it will contain slashes already. If you want to display such a value, you have to pass the value to stripslashes first. But if you want to add it to a database, then you do not need to touch it (as long as magic_quotes is on), otherwise passing it to one of the escaping function like mysql_real_escape_string will double your slashes, and the value added to the database will contain the extra slashes.

So the answer to your question is, you have to call strip_slashes prior to displaying it.

[us2000]

Again, thank you for this information. the only problem is I am not sure I understand what you are saying. I am not posting forms or adding anything to a database.

I am simply asking the browser to display the "tag line" for photos under the photo itself. The "orgin" page is a list of thumbnails someone clicks on and it loads a picture in a new window with the tag line displayed underneath it.

So when you say "you have to call strip_slashes prior to displaying it." I have no idea what you are talking about. How do I "call" the "strip_slashes" in the following:

instinct07.php4?page=003&desc=J.P. Calderon ( L ) from "Survivor: Cook Islands" with Ross Matthews from "The Tonight Show with Jay Leno" and Carey Sherrel( R ) from "The Apprentice Season 6".

or

<font size="2" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular" color="black"><b><? echo $desc;?></b></font>

[gergoe]

Instead of

<font size="2" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular" color="black"><b><? echo $desc;?></b></font>

do this:

<font size="2" face="Arial,Helvetica,Geneva,Swiss,SunSans-Regular" color="black"><b><? echo stripslashes($desc);?></b></font>  

Posing values from a form, or defining them in the url has exactly the same behavior when it comes to parsing input values. The php will read the input parameters, and adds slashes where appropriate before your script is executed. So if you have a form like this:

<form action="test.php" method="get">
<input type="text" name="test">
<input type="submit">
</form>

and you type form's test into the text box, in your php script the value of $_REQUEST['test'] will be form\'s test. But if you call the same php script like test.php?test=form's+test then the same will happen, the value of $_REQUEST['test'] will be form\'s test again, because both is handled in the same way.

So when magic_quotes are in effect, then all input parameters (get values -like form data or url parameters-, post values -from html forms with method set to post- and cookies) are treated in the same way.

[us2000]

Thanks... that worked like a charm!