Why addslashes in php

This is a guide to PHP addslashes. Here we discuss how addslashes function works in PHP along with multiple examples and its code implementation. You may also have a look at the following articles to learn more —.

Submit Next Question. By signing up, you agree to our Terms of Use and Privacy Policy. Forgot Password? This website or its third-party tools use cookies, which are necessary to its functioning and required to achieve the purposes illustrated in the cookie policy. Never use addslashes function to escape values you are going to send to mysql. Beware of using addslashes on input to the serialize function. Such a mismatch can occur if you serialize the result of addslashes and store it in a database; some databases definitely including PostgreSQL automagically strip backslashes from "special" chars in SELECT results, causing the returned string to be shorter than it was when it was serialized.

In other words, do this I'll refrain from doing such cross-posting myself I was stumped for a long time by the fact that even when using addslashes and stripslashes explicitly on the field values double quotes " still didn't seem to show up in strings read from a database.

Until I looked at the source, and realised that the field value is just truncated at the first occurrence of a double quote. For PHP 7.

In response to Krasimir Slavov and Luiz Miguel Axcar: There are several encoding schemes for inserting binary data into places it doesn't typically belong, such as databases and e-mail bodies. Here you need addslashes because you send commands to the database as command strings that contain data and thus you have to escape characters that are special in the command language like SQL.

Therefore the use of addslahses on a regex does properly store the regex in the database. However, retrieving data from a database works differently: it does not go through some string interpretation because you actually retrieve your binary data in your variables. In other words: the data stored in your variable is the unmodified binary data that your database returned.

You do not run stripslahes on data returned from a database. That way, the regexs are retrieved correctly, too. This is different from other data exchange like urlencoded strings that you exchange with your browser.

I guess some code example is needed. Seconding the code sample. I imagine this will turn out to be the difference between the treatment of '' no escaping and "" escaping to strings, though. Add a comment. Active Oldest Votes. I think I know where is a problem. DeaconDesperado DeaconDesperado 9, 8 8 gold badges 43 43 silver badges 75 75 bronze badges.

Your code example worked for me as well. However, share paths could never appear in the body of an article, they may appear once, or they may appear more than once at the discretion of the author.

But, if it's the only thing that I can get to work, then I guess I might have to do it that way. Thank you for your code example. Mike C Mike C 1, 14 14 silver badges 17 17 bronze badges. I have no control over what "variable" is. It was just an example I created for this question. The problem is not with addslashes, it is with your string.

Sign up or log in Sign up using Google. Sign up using Facebook. In the worst case, each character may need to be encoded as using two bytes, and you need room for the terminating null byte. From the manual. It can protect SQL string literal in case of some rare encodings. Your Common Sense Your Common Sense k 35 35 gold badges silver badges bronze badges.

Why would you use addslashes as a practice where you suddenly have to change your practice as soon as you work with Unicode? This isn't the case from C. The only vulnerable cases are with non-Unicode character sets such as GBK. That is, addslashes is perfectly safe for anybody who uses Unicode, and is only unsafe for people who choose to use weird national character sets in place of Unicode.

One of the extremely rare answer that addresses objectively the addslashes case. Plain common sense! Rob Rob 6, 7 7 gold badges 32 32 silver badges 38 38 bronze badges. Alan Storm Alan Storm k 86 86 gold badges silver badges bronze badges. It's supposed to escape strings for MySQL in a way that other quoting facilities don't. I guess I should clarify that I'm perfectly aware of the superiority of parameterized queries : — Michael Borgwardt. Hafiz Hafiz 3, 11 11 gold badges 55 55 silver badges bronze badges.

Sign up or log in Sign up using Google. Sign up using Facebook. Sign up using Email and Password.