Question

This is my code:

URL:

http://www.mysite.com/t.php?title=The%20Police%20-%20Don't%20Stand%20So%20Close%20to%20Me%20'86%20-

PHP:

<?php if(!empty($_GET['title'])){ >
<form method="post" action="t.php?done=yes" enctype="multipart/form-data">
<input type="text" name="title" 
<?php echo "value=\"".htmlspecialchars($_GET['title'])."\""; ?> 
> 
<input name="submit" value="Submit" type="submit" />
</form>
<?php } >


<?php if(!empty($_POST['title'])){ 
echo mysql_real_escape_string($_POST['title']);
// I have to put the string in a database ( I haven't added that part )
 } >

If I follow the first URL and then submit the form, I get this string:

The Police - Don\\\'t Stand So Close to Me \\\'86 -

instead of:

The Police - Don't Stand So Close to Me '86 -

Why ? How can I get the last string ?

Thanks

.

EDIT:

I have just discovered that magic_quotes_gpc is ON because get_magic_quotes_gpc() return TRUE.

Answer 1

It may because this string

The Police - Don't Stand So Close to Me '86 -

By magic_quotes_gpc on on your php.ini give you qoute escape

The Police - Don\'t Stand So Close to Me \'86 -

And then

echo mysql_real_escape_string($_POST['title']);

escape the ' and \ become

The Police - Don\\\'t Stand So Close to Me \\\'86 -

Try on your code to set

ini_set ( 'magic_quotes_gpc', '0' );

If not, you can check it by coding and remove slashes

if (get_magic_quotes_gpc()) {
    $title = stripslashes($_POST['title']);
}
else {
    $title = $_POST['title'];
}