PHP - Error when passing string?

Question

I am passing this via POST:

SELECT * FROM tbltesting WHERE (upper(title) LIKE '%2006%') OR (upper(category) LIKE '%2006%')

But when I echo it after being passed, it looks like this:

query: SELECT * FROM tbltesting WHERE (upper(title) LIKE \'%2006%\') OR (upper(category) LIKE \'%2006%\')

Obviously this doesn't work because of the extra slashed. How do I prevent this from happening?

Not sure what 'pot' is that your referring too. I need to pass this via POST, and I know there is a way to manipulate the sting so it won't auto escape certain variables...but I can't think what it is.

EWANG - do not have access to modify server settings

AnalProgrammer - Not using the URL to pass variable, plus, it would strip out % initially, which I need in the end

Sonny - Not sure what you are getting at, the issue is that the slashes are inserted after the pass, thus making the query unusable. I want it to pass and be identical to the original value.

Answer 1

Quick answer is stripslashes() , but, as said you should pass the variables through your urlquery not the whole mysql query through the url.

Reason you dont want to do this is all someone has to do is change the string to
SELECT * FROM tbltesting WHERE (upper(title) LIKE '%2006%') OR (upper(category) LIKE '%2006%'; DELETE FROM tbltesting; as the url query

Answer 2

try adding this to the top of your file:


this should turn off magic_quotes_gpc without access to php.ini (I'm not sure if it works in all versions of php)

edit: on second thought I'm pretty sure ini_set wont work for magic_quotes. You'll need to disable magic_quotes through a .htaccess file

the following line should do it:
php_value magic_quotes_gpc 0

if the .htaccess file is in the site root directory that should disable magic_quotes for the entire site

Answer 3

You are better off passing the variables through pot, and then creating the string on receiving them. Post and get are much better used to pass smaller variables.

Answer 4

try this:
SELECT * FROM `tbltesting` WHERE (UPPER(`title`) LIKE '%2006%') OR (UPPER(`category`) LIKE '%2006%')

but i think the problem isn't syntax, It's from other line of ur code

Answer 5

Turn off the magic quote settings in php.ini, and then restart web server.

magic_quotes_gpc = Off

Answer 6

Try the urlencode and urldecode functions.
Details below.