Question

My problem seem’s trivial but I havn’t found any “good” solution to this.

First a question that I’ve heard many answers on, when to we need to parse a string with mysql_real_escape_string()? My thought is that it’s only needed when to store user given data in a database, is that a good rule to follow?

My second question and that’s the real problem. When I parse a string with mysql_real_escape_string(), it will put a special character \ before any harmful character in the string, ex. if the function finds a ' then it will be appended with a \ so the result is \'.

Well ok, that’s fine, the problem is when I read the same string from the database, then I also get the \ character. Is there any good way to get rid of \ character?
One thought I’ve had is to use the str_replace("\\","",$string), but is this a good and safe way to do this?

Thank you all!

Answer 1

First, the use of mysql_real_escape_string is discouraged. Check if magic_quotes are on:

echo "Magic quotes is " . (get_magic_quotes_gpc() ? "ON" : "OFF");

Or you can use stripslashes