Question

I have a form that has some text inputs. When I add them to my db I get a ‘\’ character before each special character {‘, “, etc}. I want to remove the ‘\’ before entering the text into the DB but so far I have been unable to. I tried doing in the PHP before I execute the query:

$title_str = str_replace('\'','',$_POST['main_title']);

But it did not work.

Thanks,

Answer 1

Sounds like magic quotes are still turned on. You should disable them. This is a perfectly safe thing to do.

http://www.php.net/manual/en/security.magicquotes.disabling.php

Also, be sure to use prepared queries (with PDO or similar) when inserting data in your database to avoid SQL injection problems.