Question

This might be a really stupid and self-answering question: I am stripping down my submissions like so (but need to submit to my table and also echo out the data to the screen):

$num_of_badges = stripslashes(trim(mysql_real_escape_string($_POST['num_of_badges'])));

Of course the data is passed, but does the stripslashes()``** here defeat the purpose ofmysql_real_escape()`?

So: Bill’s becomes Bills in the table and echo on the screen.

Answer 1

need to submit to my table and also echo out the data to the screen

this statement is a key of all your problems.

while trim() and conditional stripslashes() are “submissions” related, mysql_real_escape_string is completely different matter, it has nothing to do with submissions, input, output and all that stuff. It has relation to SQL queries only.

So, these functions should never be mixed.

• stripslashes should be conditional. only if magic quotes is on. can be checked with get_magic_quotes_gpc(). Applied to HTTP input variables only.
• trim is quite useless most of time but let it be, apply it to input.

these two above can be used blindly, at the top of your code. but third one,

• mysql_real_escape_string, as it’s been said already, is completely different matter. It should be used on the strings that going to be inserted into query. Not on strings going to be echoed on screen. Not on numbers or identifiers, but strings (quoted blocks of data) going into query. So, mysql_real_escape_string can be used right before query building and nowhere else. And should be very last action done on your data before it goes to be inserted into query.

And also I hope you’re not going to print your data right after inserting it into database.
You rather have tho make a redirect, and then read your newly written data back from database.