Question

in order to keep safe was told to

use mysql_real_escape_string before sending to Mysql if i’d be displayed

well i do:

....

   $b = mysql_real_escape_string($b);
   $r_int = mysql_real_escape_string($r_int);
   $r_ext= mysql_real_escape_string($r_ext);

   $id_tmp = $_SESSION['id'];
   $insert = "INSERT INTO table (nombre, coment, iduser,fecha)
                           VALUES ('$b','$r_int','$id_tmp',NOW())";
....

But if those values contained any <a href="where">go</a> it will turn into <a href="\where\">go</a>

and.. i can’t go! haha,

how can i solve this and keep safe?

thank you!

Answer 1

stripslashes function of PHP

echo stripslashes($string);

takes out the slashes and displays it like it was originally