php: character \ in an input

eantoranz · 09-27-2006, 11:50 AM

I'm creating one PHP application what will read a string and will write it in one LDAP (Active Directory) to set it as a user's profilePath. So far so good, I've been able to write stuff into the AD without a problem, however I want to make it in a web page so I can make as may tries as necessary.

I'm testing rigth now and I have noticed that when I write a \ in a text input, in PHP it's read as '\\'.

Even when I render the page I happen to place the value that was read in the value of the input, and I get to see a \\ for each time I wrote a \ in the request. If I wrote \\hello, I'll get \\\\hello in the refresh of the field.

How can I avoid that behavior?

Simplified problem:

Code:

$afield = $_GET['afield'];
?>
<input type="text" name="afield" value="<?= htmlentities($afield) ?>">
<?

senyahnoj · 09-27-2006, 11:54 AM

Try using the stripslashes() function:

http://uk2.php.net/manual/en/function.stripslashes.php

eantoranz · 09-27-2006, 12:00 PM

It worked. Thanks!!!

Wim Sturkenboom · 09-27-2006, 11:03 PM

I think an explanantion should be here.

Why do you need to use stripslashes in this situation? If you did not use addslashes (to add the backslash), this is caused by a setting in php.ini called magic_quotes_gpc.
You can create a php page that calls phpinfo to display configuration information to check.

If magic_quotes_gpc is on, an additional backslash will be added for characters like single and double quote and backslash. If magic_quotes_gpc is off, this will not happen.

Be carefull as there might be some issues here:
1)
If you are not in control of the webserver, you depend on what the administrator sets magic_quotes_gpc to. If you are in control, you can determine the setting.
This is a global setting for all sites that are served from the server (so an administator might be reluctant to change the setting and if you're the administrator you should be aware of the implications of randomly changing it).
2)
I've read an article a while ago (could not locate it now) that magic_quotes_gpc will disappear in the future and will be set to off. So your stripslashes might have the site-effect that it strips the backslash in the actual data.

To prevent problems in future, you might want to use the following code that will check if magic_quotes_gpc is on and only strip in that case

Code:

function dostripslashes($str)
{
    if(get_magic_quotes_gpc())
        $str=stripslashes($str);

    return $str;
}

In a similar fashion, you can have a function that adds the slashes when necessary

Code:

function doaddslashes($str)
{
    if(!get_magic_quotes_gpc())
        $str=addslashes($str);

    return $str;
}