How do I retrieve “escaped” strings from db?

问题:

I'm doing this to all strings before inserting them:

mysql_real_escape_string($_POST['position']);

How do I remove the: \ after retriving them?

So I don't end up with: \"Piza\"

Also is this enough security or should I do something else?

Thanks

回答1:

use stripslashes() to get rid of the escape character.

Escaping is great. In case the value is going to be integer , I would suggest you do it like:

$value = (int) $_POST['some_int_field'];

This would make sure you always end up with an integer value.

回答2:

I would suggest you call $_POST['position'] directly (don't call mysql_real_escape_string on it) to get the non-escaped version.

Incidentally your comment about security suggests a bit of trouble understanding things.

One way of handling strings is to handle the escaped versions, which leads to one kind of difficulty, while another is to handle another and escape strings just before embedding, which leads to another kind of difficulty. I much prefer the latter.

回答3:

It could be because magic quotes are enabled, so to make it versatile, use this:

if (get_magic_quotes_gpc()) { // Check if magic quotes are enabled
        $position = stripslashes($_POST['position']);
    } else {
        $position = mysql_real_escape_string($_POST['position']);
}

回答4:

mysql_real_escape_string() does add \s in your SQL strings but they should not be making it into the database as they are only there for the purpose of string parsing.

If you are seeing \s in you database then something else is escaping your stings before you call mysql_real_escape_string(). Check to make sure that magic_quotes_gpc isn't turned on.