Question

I have to escape some inputs on a form. I used mysql_real_escape_string to escape the value but it adds a lot slashes with value inside database, the reason is i have an apostrophe in my input let us say exp’s.

Now to get rid of slashes, I use stripslashes after mysql_real_escape_string and then data goes to database successfully and don’t see any apostrophe with value in database.

$name = mysql_real_escape_string(trim($_POST['userame']));
$name = stripslashes(stripslashes($userame));

// then data goes to db successfully without apostrophe

I just wanted to confirm, is this correct way of escaping the input value? Thanks

Dayan

Answer 1

1. Disabling Magic Quotes
2. mysql_real_escape_string(stripslashes($_POST['username']));