Question

Alright I’ve been messing around with this for hours now and I still can’t get it right so I’m gonna ask you guys.

I have a textarea in html, The value needs to be send to php using ajax(jquery) then imputed to the database, and printable again using php. The problem is i want when printing to be 100% the same as what you typed in. including characters like ' and \

How I do it now:

var comment = escape( box.find('#newCommentArea').val() ).replace(new RegExp( "\\+", "g" ),"%2B");

Where box.find('#newCommentArea').val() is the value. I pass comment to php using ajax function and submit it as POST data.

using firebug this is what is appears to send: comment=asdf%27asdf

printing $_POST['comment'] in php gives me asdf\'asdf

the added \ is a problem. and i need to get rid of it.

either way because only javascript escape isn’t safe in php i also do urlencode()

and when printing i use rawurldecode()

Could you guys point out if this method is good, or if it could be done better.

And how do i get rid of the new \ in $_POST['comment']

Thanks in advance,

MakuraYami

Answer 1

The slashes are automatically added, a setting of PHP or the server which can be changed (but usually shouldn’t). You can reverse it using stripslashes() (PHP: stripslashes). Use this function immediately before displaying, so not before storing in the database.

You don’t need to urlencode in PHP anymore if it was already sent (the urlencode needs to be before sending), you just need to make sure it’s database safe.

Unfortunately I can’t advise you on what’s the best way for URL encoding, I tend to get confused by it myself 🙂 Hopefully someone else will be able to clarify that.