Question

I’m using prepare statements in mysqli and if I put a " into one of my params values then it escapes it and adds a backslash before it. I though mysqli didn’t have to do this?? Thanks. Example:

$comment = $members->prepare("insert into comments(comment) values(?)");
$comment->bind_param('s', $_POST['comment']);
$comment->execute();

puts \”\” into the database assuming that the comment field is equal to “”

Answer 1

Your server may have magic quotes on. Check it out here http://php.net/manual/en/security.magicquotes.php It’s happened to me before, very annoying.

quick check to see

if(get_magic_quotes_gpc())
        echo "Magic quotes are enabled";
    else
        echo "Magic quotes are disabled";