PHP - Don't use "\" in MySQL query

Question

I wasn't exactly sure how to word this, but essentially what I need is so when I send a SELECT query in MySQL, it doesn't pay attention to the escape character ( \ ) in the search. For example, if the name I am searching for is foo'bar and I send foo\'bar to the server, is there a way to make the server find foo'bar? This is the MySQL query currently:

function escape_data($data) {


    $data = mysql_escape_string (trim($data));
    $data = strip_tags($data);

return $data;

}

$champ1 = escape_data($_GET['champ1']);

 foreach($db->query("SELECT * FROM champs WHERE name = '$champ1'") as $row) {
                $role_verify_1 = $row[$role];

             }

the only way I can get foo'bar to return is if I change it to foo\'bar in the MySQL database and I would like not to if it is possible.

Are you previously calling addslashes() or using the long-since-deprecated-please-don't-use-in-modern-code magic_quotes_gpc? — Michael Berkowski
– Michael Berkowski, Commented Apr 9, 2014 at 13:21
stripslashes() can be applied before mysql_real_escape_string() but it would be better to fix your data source... — Michael Berkowski
– Michael Berkowski, Commented Apr 9, 2014 at 13:22
Switching to prepared statements is probably the best choice but my opinion is not valid so carry on. — MonkeyZeus
– MonkeyZeus, Commented Apr 9, 2014 at 13:34

Community · Accepted Answer · 2023-11-17 20:24:57Z

1

The function you want is stripslashes before mysql_real_escape_string, however your real concern should be where the slashes are actually coming from - it looks like you might have magic quotes turned on. This is deprecated - check the link for instructions on disabling it.

edited Nov 17, 2023 at 20:24

CommunityBot

11 silver badge

answered Apr 9, 2014 at 13:23

Zebra North

11.5k7 gold badges40 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Burak Tokak · Accepted Answer · 2014-04-09 13:30:08Z

0

The Syntax at PHP requires that.

For example;

   name = '$champ1'

Here you have a variable in ' tags. But that variable includes ' inside like foo'bar, its turn to that.

   name = 'foo'bar'

as you see php can't understand what is going on there. So it need to clear that problem like adding before ' an \. And inserted item will have slashes before aphostropes.

As a solution you can delete the backslashes before you echo the variable.

$theVariable = str_replace("\", "", $theVariable);

Or you can use PHP's upper version's functions. like stripslashes() before you insert your data.

Good luck.

answered Apr 9, 2014 at 13:30

Burak Tokak

1,8901 gold badge20 silver badges27 bronze badges

Collectives™ on Stack Overflow

PHP - Don't use "\" in MySQL query

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related