stripslashes function in PHP? Doesn't seem to work...

[Go7hic13]

I've been trying to get the stripslashes() function in a PHP script to work but I'm not having any luck.  It seems like a very straightforward function but I'm still ending up with slashes in my comment/text area data.  Can anyone help?  I have some PHP books but they barely touch on the functionality.  (I'm new to PHP).  Thanks!  (BTW...  I removed the various attempts at calling the stripslashes() function).  The field I'm trying to remove the slashes from is the 'comment' variable.

Here is my short php script:

<?php // Script 1.0 - contactlist.php

if (isset($_POST['submit']) && !empty($_POST['submit'])) // Test if submit button named submit was clicked and not empty

{

          if (!empty($_POST['first']) && !empty($_POST['last'])  && !empty($_POST['email']) && !empty($_POST['phone']) && !empty($_POST['comment'])) {

                    $body = "First Name: {$_POST['first']}\nLast Name: {$_POST['last']}\nEmail Address: {$_POST['email']}\nContact Phone Number: {$_POST['phone']}\nContact Preference: {$_POST['contactvia']}\n\nBest Time To Contact: {$_POST['timepref']}\n\nComments:\n {$_POST['comment']}";

                    $body = wordwrap($body, 70);

                    mail('someone@somewhere.net', 'NEW Customer Inquiry Submission',$body, "From: {$_POST['email']}");

                    header('Location: index.html');  //Redirect to new url if form submitted

     }

}

?>

[bregent]

Why are you needing to remove the slashes? Is magic quotes enabled? Are you using addslashes() somewhere?  What version of PHP are you running?

[Go7hic13]

I'm assuming magic quotes is enabled.  I'm running sql/php v5.0 I believe.  I'm not adding any slashes either...  They are just there whenever I use a quote in the comment field.

[Go7hic13]

Sorry...  It looks like I have PHP v5.3

[Ben M]

You are getting way ahead of yourself Prodigy and maybe I am a bit too.  Bregent, in a previous post I was explaining that nothing in the form was being validated.  Originally the form was being processed by

if ($_SERVER['REQUEST_METHOD'] == 'POST')) {

He was using forms setup up redirects that were not working and a put of other things going on.  I started to explain the importance of sanitizing data so that nothing malicious comes of the script.  Because there is no database involved, mysqli_real_escape_string won't do the trick so I started to explain the stripslashes/addslashes and about converting to html entities ( http://php.net/manual/en/function.htmlspecialchars.php ).

Prodigy, add/strip slashes is not what you need, it was just an example to make you look at what you are putting into a script.

Since you don't send an HTML email, you don't need to worry about htmlspecialchars.  Take a read through this tutorial about sanitizing data.  This probably would have a better place to start you off looking back instead of jumping too far ahead.

http://www.w3schools.com/php/php_secure_mail.asp

[Go7hic13]

Hi again snakeyes...  The only reason I was trying to use the stripslashes was because the slashes are placed into the email when it gets sent to email address.  Although, not terrible it didn't look quite right when you are using words like "I'm" or "I'd" and it places a slash in the comments.  Is there a way around this?  Is this magic quotes in the works?  I'll check out the link you sent to a while.  I do appreciate the help you've given me so far...  The header() function works great now.

[Ben M]

The reason for slashes is to prevent malicious code from being inserted and slashes make things into comments, likewise with htmlspecial chars converting symbols and the like from & --> & just as a basic example I can think of off the top of my head.  The point I want you to understand is that if you expect something, check for it and don't expect that it will only be as you expect because two people don't always think alike.  If your site is small enough, with low traffic, this might all be overkill for you, but it's good to understand if you ever run into problems and I always err on the side of caution.

[bregent]

Thanks for the background explanation SnakeEyez,

If he's ending up with slashes in his text posted from a form, and he's not adding them with addslashes() or some other function, then it sounds like magic_quotes is enabled, right?

If so, it should be disabled, right?

[Ben M]

Usually bregent.  But there are instances where I have seen characters not be translated properly.  In those cases running htmlspecialchars would do the trick.  However, if sending a plain text, non-html, email as in this example. using HTML characters can get messy and you never really have the opportunity to convert it back to text. So validating the input as in the w3schools example will remove any illegal characters from the strings and prevent injection against simple email scripts.

[Go7hic13]

OK...  I appreciate both of your help.  So, where is the best place for me to start?  Do I contact someone on the server side to turn magic quotes off?  or should I just try the example from the W3Schools example?  or both I guess?  I just like the users to be able to type a short message and not end up with slashes in the text when it's displayed in an email...

[bregent]

Both. You always want to validate all user input.

Next, determine if magic quotes is indeed enabled: http://www.php.net/manual/en/function.get-magic-quotes-gpc.php

You may be able to disable magic quotes yourself: http://www.php.net/manual/en/security.magicquotes.disabling.php

First

[Go7hic13]

With the first example I receive an error message...  Something referring to mysql.

The 2nd example didn't seem to help...  The script ran without a hitch but the slashes were still in the comment section of the generated email.  This is of course assumming I'm executing the script properly.  I'm not able to tell as I just started to us PHP.  I understand the code (I used to be a c coder) but as far as PHP script writing I have no idea of how to create it yet. 

Is this something I should ask the hosting company about?  I couldn't find any information on magic quotes in their FAQ or Help sections.  I am certain however I running PHP 5.3 though.

So lost...  at the moment.  

[Go7hic13]

Can you tell me why my use of the stripslashes command below does not work?  I've tried multiple variations using stripslashes and each time I still see slashes in any comment which contains a quote.

<?php // Script 1.0 - contactlist.php

if (isset($_POST['submit']) && !empty($_POST['submit'])) // Test if submit button named submit was clicked and not empty

{

          if (!empty($_POST['first']) && !empty($_POST['last'])  && !empty($_POST['email']) && !empty($_POST['phone']) && !empty($_POST['comment'])) {

                    $body = "First Name: {$_POST['first']}\nLast Name: {$_POST['last']}\nEmail Address: {$_POST['email']}\nContact Phone Number: {$_POST['phone']}\nContact Preference: {$_POST['contactvia']}\n\nBest Time To Contact: {$_POST['timepref']}\n\nComments:\n {$_POST[stripslashes('comment')]}";

                    $body = wordwrap($body, 70);

                    mail('someone@somplace.net', 'NEW Customer Inquiry Submission',$body, "From: {$_POST['email']}");

                    header('Location: index.html');  //Redirect to new url if form submitted

     }

}

?>

[bregent]

>{$_POST[stripslashes('comment')]}";

Because there are no slashes in the string literal 'comment' You need to put the stripslashes function around the variable:

{stripslashes ($_POST['comment'])}";

But first follow SnakeEyez instruction for checking magic quotes. That's probably where the slashes are coming from.

[Ben M]

Make a document, call it info.php.  In the document put:

<?php phpinfo(); ?>

Then upload and view the file from your server.  Check to see if magic quotes are enabled, just do a ctrl+f to find it on that document quickly.  Then delete the file, it's not something you want to leave up with paths and other information.

[Go7hic13]

Yes...  They seem to be...

magic_quotes_gpc	On	On
magic_quotes_runtime	Off	Off
magic_quotes_sybase	Off	Off

[Ben M]

Personally I would check with your host on this one.  This a feature that was removed from the PHP installation (deprecated as of 5.3 and removed from 5.4) and should be turned off at the server level.

[Go7hic13]

I agree...  or at least upgrade me to PHP 5.4....  I still can't seem to get the stripslashes function to work.  But the w3schools link is VERY helpful in getting my feet wet on PHP.  Thanks for your help there...  I read through about 12 or so chapters yesterday.

[bregent]

>I still can't seem to get the stripslashes function to work.

Show us what you are trying.

[Go7hic13]

Well...  I finally got it to work.  Explanation::

1. I didn't use the stripslashes() function

2. I edited the php.ini file.

3. I changed the name of the php.ini file to php5.ini

4. I added the following code at the bottom of the php5.ini file::

magic_quotes_gpc = off;

That's it...  I talked to the host support team and they said they use either PHP5.2 or PHP5.3 on their servers and I couldn't upgrade to PHP5.4 (Which automatically disables magic quotes).  Now though when I do a phpinfo() I can see Magic Quotes is definitely turned off.

I still would really like to know though how to use the stripslashes command.  It bugs me it doesn't work in the many ways I tried incorporating it. 

[Ben M]

That's it...  I talked to the host support team and they said they use either PHP5.2 or PHP5.3 on their servers and I couldn't upgrade to PHP5.4 (Which automatically disables magic quotes).  Now though when I do a phpinfo() I can see Magic Quotes is definitely turned off.

That's troubling to hear.  Not the PHP 5.4 part, but the fact that the host wants you to disable this on the user level instead of the server level is very disturbing and I would recommend looking for another host because they obviously don't know what it's being disabled.  There has always been talk that PHP 6 would be the one to do away with it, but they deprecated in PHP 5.3 and disabled in PHP 5.4 for a reason.  On a server level, not all data needs to be escaped.  Thus the reason it was taken away in favor of SQL functions was to avoid high server resource usage by escaping all data.  Here's a link to the PHP official explanation:

http://www.php.net/manual/en/security.magicquotes.what.php

Personally the hosts I've been with have had this disabled since early on in the PHP 5 release cycles.  The fact that they are up to PHP 5.3 and still have them enabled is troubling.

The stripslashes should have worked in your case, if not as bregent previously mentioned we would need to see the code to evaluate what's going on.

[Go7hic13]

I agree with you about the host not being able to install (or at least don't want to install/upgrade) their servers to php5.4...  Unfortunately, I can't change that...  but by shutting them off took care of all the quotes (single & double) and any other characters which would basically function like an addslashes() command.  I'll paste the script below...  It's still pretty much the same as when you helped me out with the script...  Just minor adjustments:::  If you can show me (even though I fixed the problem) how I would integrate the stripslashes() function to the comment field it would be helpful to know for future reference.

<?php // Script 1.0 - contactlist.php

if (isset($_POST['submit']) && !empty($_POST['submit'])) // Test if submit button named submit was clicked and not empty

{

          if (!empty($_POST['first']) && !empty($_POST['last'])  && !empty($_POST['email']) && !empty($_POST['phone']) && !empty($_POST['comment'])) {

$comment=stripslashes($_POST[comment]);

                    $body = "First Name: {$_POST['first']}\nLast Name: {$_POST['last']}\nEmail Address: {$_POST['email']}\nContact Phone Number: {$_POST['phone']}\nContact Preference: {$_POST['contactvia']}\n\nBest Time To Contact: {$_POST['timepref']}\n\nComments:\n {$_POST['comment']}";

                    $body = wordwrap($body, 70);

                    mail(someone@somewhere.net', 'NEW Customer Inquiry Submission',$body, "From: {$_POST['email']}");

                    header('Location: index.html');  //Redirect to new url if form submitted

     }

}

?>

[bregent]

>$comment=stripslashes($_POST[comment]);

I believe that you need to quote the field name: $comment=stripslashes($_POST['comment']);

However, your main problem is that you're not  assigning the $comment variable to your $body variable. You instead are assigning the (un-stripped) posted value