Question

For wont of avoiding SQL injection attacks, I’m looking to cleanse all of the text (and most other data) entered by the user of my website before sending it into the database for storage.

I was under the impression that the function inserted backslashes ( \ ) before all characters capable of being malicious ( \n , ‘ , ” , etc ), and expected that the returned string would contain the newly added backslashes.

I performed a simple test on a made up string containing such potentially malicious characters and echo’d it to the document, seeing exactly what I expected: the string with backslashes escaping these characters.

So, I proceeded to add the cleansing function to the data before storing into the database. I inserted it (mysqli_real_escape_string( $link , $string)) into the query I build for data storage. Testing the script, I was surprised (a bit to my chagrin) to notice that the data stored in the database did not seem to contain the backslashes. I tested and tested and tested, but all to no avail, and I’m at a loss…

Any suggestions? Am I missing something? I was expecting to then have to remove the backslashes with the stripslashes($string) function, but there doesn’t seem to be anything to strip…

Answer 1

When you view your data in the database after a successful insert, having escaped it with mysql_real_escape_string(), you will not see the backslashes in the database. This is because the escaping backslashes are only needed in the SQL query statement. mysql_real_escape_string() sanitizes it for insert (or update, or other query input) but doesn’t result in a permanently modified version of the data when it is stored.

In general, you do not want to store modified or sanitized data in your database, but instead should be storing the data in its original version. For example, it is best practice to store complete HTML strings, rather than to store HTML that has been encoded with PHP’s htmlspecialchars().

When you retrieve it back out from the database, there is no need for stripslashes() or other similar unescaping. There are some legacy (mis-)features of PHP like magic_quotes_gpc that had been designed to protect programmers from themselves by automatically adding backslashes to quoted strings, requiring `stripslashes() to be used on output, but those features have been deprecated and now mostly removed.