Question

So i have a page where i have stored the users username as a cookie and use it for different things. However i have hit a wall. If the username contains anything that is / when using escape_string things act up. I was able to get the username to be echo‘ed correctly on one page however on another page i am not able to get it to come up properly. If i just echo the cookie on that page straight up i get / (the username im using is “” just to test). My server seems to auto escape variables sometimes so i am not 100% sure when it auto applies slashes and when it doesn’t, as when i send out variables using php (sending out email with variable) they are escaped and when i save them to the database (sending variable to mysql) they are not slashed? So here is my code for everything i think might help, keep in mind the username in this case is “”.

Registering the username:

 $username = mysql_real_escape_string($_POST['username']);

Setting up the cookie:

$username = mysql_real_escape_string($_GET['username']);
$user = stripslashes($username);
setcookie('username', $user, time()+3600*24);

Working page:

  if(isset($_COOKIE['username']))
   { 
  $login = '<a id="popup_link_3" class="popup_link menu"><span>' . stripslashes($_COOKIE['username']) . '</span></a>'; }
else{ 
 $login = '<a  id="popup_link_2" class="popup_link menu"><span>Login</span></a>';
 } 

here is where the username is echoed on the working page and i see “”:

 <? echo $content1 ?>
 <li> <? echo $login ?></li>
 <? echo $content2 ?>

Non working page:

 $username = $_COOKIE["username"];

what i see when i echo $username is / and when i stripslashes i see nothing.

cookie value when viewed through firefox after being set:%22%22

Answer 1

Why are you using mysql_real_escape_string() for this? The function is intended to make a string safe to insert into a MySQL database query string. it is not, and never has been, intended to be used for usage in a cookie. As long as you’re using setcookie(), PHP will take care of escaping any data going into the cookie.