I have made a form ( http://www.rhstrack.com/bio.htm ) that puts the information onto another page. The problem is that it puts a back slash ( / ) before any quote marks ( " ) - which are used because the form asks for a quote. How do I get around this?

Also, how might I go about allowing people to save the page they have created?

Dani AI

Generated

Short answer: those backslashes are almost always added before the data reaches the page — either by an automatic, server-side escaping step (the old “magic quotes” behaviour) or by application code that escaped the value before storing or re-outputting it. pointed to the magic-quotes era; that feature caused exactly this symptom and was later deprecated/removed because it led to double-escaping and other problems. (wiki.php.net)

How to diagnose: inspect the page source — if the backslashes appear in View Source they were emitted by the server; if they only show in rendered text but not in source, client-side code is likely altering the string. For a reliable server-side check, write a short debug dump of the incoming data (for example, serialize/var_export the POST array into a temporary file) or inspect the raw input stream; use that short-lived dump to see whether the slashes are present before any formatting. (Use a temporary path and remove the file afterwards.) ()

How to fix it properly: stop relying on global escaping and treat escaping as a context-specific output step. Store the original text (no global addslashes), protect database writes with parameterized/prepared statements, and escape only where needed for HTML output (so quotes display cleanly and XSS is prevented). For HTML output, use the standard HTML-escaping routine so user quotes are shown correctly while keeping the page safe. ()

To let visitors save a generated page, don’t ask them to “Save As” from a form POST. Instead either (a) save a server-side static HTML file and link to it, or (b) stream the generated HTML back with an HTTP Content-Disposition: attachment header so the browser prompts to download a .html file. Below are two lightweight patterns to implement those options.

<?php
// stream-as-download pattern
header('Content-Type: text/html; charset=UTF-8');
header('Content-Disposition: attachment; filename="profile.html"');
echo $generatedHtml;
exit;
?>
<?php
// save-to-disk pattern
$path = '/path/to/saves/' . uniqid('profile_', true) . '.html';
file_put_contents($path, $generatedHtml, LOCK_EX);
echo '/saves/' . basename($path);
?>

Content-disposition behaviour is standardized (browsers will usually prompt/save when you use attachment), and server-side file writes follow the usual PHP file APIs. (datatracker.ietf.org)

Notes: ’s and ’s suggestions are useful quick workarounds for display, but the long-term fix is to remove/adapt any automatic-escaping in the request flow and adopt context-aware escaping (HTML on output, parameterized SQL on DB writes).

Recommended Answers

All 5 Replies

So the form adds the slashes for you? Well that's how it's supposed to be I believe, otherwise it would mess up with the " quotes around the entire thing :)

What you do is use this function: stripslashes(); to strip the slashes from the string.

Also, to allow people to save the pages, make a link to the page and then just tell them to right-click the link and then use the 'Save As' option to save the page.

instead of having them put quote marks for the quote just have them put the quote and on the next page use quotes around the provided text;)

Also, to allow people to save the pages, make a link to the page and then just tell them to right-click the link and then use the 'Save As' option to save the page.

That doesn't work. I figure it doesn't work because it is a form so the content isn't really on the page?

If you used GET instead of POST method for the form then it would work (but that might make URL extremely long.)

You could also simply tell the user how to use their 'Save Page As' feature in their browser :)

Hi

Turn 'OFF' (magic_quotes_gpc, magic_quotes_runtime)

You should learn to handle incoming 'FORM DATA' in your script, one should never use php.ini setting if they can control it in the script!

If your own shared hosting, and are not allowed access to the php.ini, you can turn this off via 'htaccess' -> per directory

example...

htaccess file -> below this line
php_flag magic_quotes_runtime Off
htaccess file -> above this line

If you want to turn it Off in your script!

At the top of your script! (turn it off)

<?
set_magic_quotes_runtime(0);
?>

At the bottom of your script! (turn it back on)

<?
set_magic_quotes_runtime(get_magic_quotes_gpc());
?>


Then in your script handle each 'FORM DATA' being sent to your script!


J!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.