Question

I have my input placed into mySQL through a PDO prepared statement, and have it placed in my website with PHP using htmlspecialchars() to protect against XSS. Only problem is now I get slashes, before any quotes, that are visible on the webpage to the user it only happens when I upload it to the server. Never happens on my localhost.

Why is this happening?

Answer 1

The server has magic quotes enabled?

Try this line in PHP to find out:

if(get_magic_quotes_gpc())
    echo "Magic quotes are enabled";
else
    echo "Magic quotes are disabled";

If they are enabled, you can use stripslashes to remove them.