Taking care of quotes in repost URL

[Claes100]

Hi all,
I use php for form validation. In case a field does not validate ok, I have a rePost function:

foreach ($_POST as $field => $value) {
 $q .= $field."=".urlencode(htmlspecialchars($value, ENT_QUOTES))."&";
}
header("Location: new_member.php?error=".$errField."&".$q); die(); 

But when receiving the query string in the original form as:

<input id="fname" name="fname" maxlength="30" tabindex="1" value="<?=htmlspecialchars_decode(urldecode($_GET["fname"]), ENT_QUOTES)?>" /> die(); 

... I still get backslashed quotes (\\"This is a double quote entered in a form field\\").
What am I doing wrong here...? Thanks!

/Claes

[whoisgregg]

Maybe you have magic quotes [php.net] on?

If you do, now's the time to disable them [php.net] for good!

[Claes100]

Yes, magic quotes was on at my host's server...
However, changing to:

foreach ($_POST as $field => $value) {
 $q .= $field."=".urlencode(stripslashes($value))."&";
}
header("Location: new_member.php?error=".$errField."&".$q); die();

and then

<input... value="<?=stripslashes(urldecode($_GET['fname']))?>"/>

in the original form made it work OK.

Thanks
/Claes

[Claes100]

I didn't realize I could disable magic quotes in the .htaccess file as shown in whoisgregg's link above.
But... setting
php_flag magic_quotes_gpc Off
in htaccess didn't make any difference for me after removing the stripslashes(). A single quote gets reposted as "Brind\\\'Amour".

[whoisgregg]

setting php_flag magic_quotes_gpc Off in htaccess

Not all servers support that method... You can make a quick phpinfo [php.net]() page in the same directory as your .htaccess rule and check to see if it is actually disabling magic quotes.

[Claes100]

Looking at phpinfo, the local value is actually Off:

magic_quotes_gpc Off On
magic_quotes_runtime Off Off

I thought I then could skip the stripslashes() in the rePost function:

foreach ($_POST as $field => $value) {
 $q .= $field."=".urlencode($value)."&";
}
header("Location: new_member.php?error=".$errField."&".$q);

and in the original form field (new_member.php):

<input... value="<?=urldecode($_GET["fname"])?>"/>
header("Location: new_member.php?error=".$errField."&".$q);

But the entered name d'Artagnan then gets reposted as d\\\'Artagnan.
Works OK though with urlencode(stripslashes(..)) and then stripslashes(urlencode(..))
/Claes