God bless stripslashes!

[the pale e]

I was having a problem with slashes being added in from a text field while passing data from swf to a little PHP writting script!  But rejoice! Adding stripslashes to the script cleaned it up SLICKLY!  One line, and my suffering was OVER!

<?

$text = stripslashes($text); //this line works some sexy magic!

$filename = $current;
$out = fopen($filename, "w+");
fwrite ($out,"text=".$text);
fclose ($out);

?>

Thanks Jeff!  Thanks Flash DB!

Thx,
the pale e

[Musicman]

A comment on the real virtues of slashes: if you use database (e.g. mysql) and someone adds a ' to their input, this is likely to produce invalid sql syntax. It is also possible to create "harmful" sql.
So php escapes all user-provided variables to prevent mischief. If you need data values for anything but database, you usually want to stripslashes

Musicman

[Flash-db]

Hey Musicman,

I had a couple of questions regarding this area.  First of all, I used to use some regular expressions to filter the data and replace anything and everything that wasn't considered safe.  An example would be:

$email = ereg_replace("[^A-Za-z0-9 \@\.\-\ ]", "", $email);

But as you can tell this gets really annoying.  And their's always some symbol that someone want's to use or uses at some point (like a ~) that I had not included.  So my question is what's the best way to filter the data and make sure that all of the characters are safe and will not cause an SQL error.  And what would be some examples of character patterns that would cause an Error - I can think of some - but I'm sure you've got a better idea of what they would be.  

Is their a standard reg ex, filter method, or function that is safe to use on all text entered into a database - where their is no chance that any of the characters will cause an error.  

Thanks.

[Musicman]

Hi,

addslashes() is safe for database use, but you may still want to check other data fields according to rules specific for those fields. But, you are right, you will eventually find valid input that a given regex does not handle.
Especially very sophisticated ones (like some email checkers) in fact block valid input that the designer of the regex did not anticipate.
Examples for this: a domain name may well include a dash, there may be three dots like in john@johnssite.provider.com, and with .name, .museum etc. domains the tld part is no longer restricted to 2 or 3 chars

Musicman