Question

I have a problem with mysql_real_escape_string and addslashes. I have a form in my PHP file where it is $_POST['title'], then I have:

$title = mysql_real_escape_string(addslashes($_POST['title']));

And I insert $title into my db. When I want to get this value from my db I have:

$title = stripslashes($results['title']); 

Problem is when I submit something like this: abs"'@, my result is: abs\"\'@.

I don’t know where the bug is.

Answer 1

Don’t bother using addslashes at all, mysql_real_escape_string is more than capable of doing it on its own. So use:

$title = mysql_real_escape_string($_POST['title']);

And remove the stripslashes from your retrieval code. If the problem persists, you probably have one of the magic_quotes options on – if so, turn it off!