QUOTE(Jared @ May 6 2008, 06:25 AM)
I've thought about stripslashes (), but I don't think it's helpful in this case... stripping the slashes out of 's Stuff is still 's Stuff. And before my script is even processed all the $_FILES data is already set. So unfortunately it wouldn't be possible to strip the slashes out before the data is stored in the array. And also there is no set_magic_quotes_gpc () function to get rid of the magic quotes for the $_FILES array.
I am truly clueless.
When i need to handle strings that must be escaped or not, I use a function that first tests if the
Magic quotes is on with the
get_magic_quotes_gpc() function, if it is true simply returns the string and if it is false it returns the string escaped with the
mysql_real_escape_string() function.
CODE
<?php
function safeEscapeString($string)
{
if (get_magic_quotes_gpc()) {
return $string;
}
else {
return mysql_real_escape_string($string);
}
}
?>
This function works perfect if you need to insert or update your database data and as i just discover it does not work with uploaded files, so, to work with files you only need to add the stripslashes() function to the Magic quotes test.
CODE
<?php
function safeEscapeString1($string)
{
if (get_magic_quotes_gpc()) {
return stripslashes($string);
}
else {
return mysql_real_escape_string($string);
}
}
?>
I hope it helps you and BTW I test this code only with Internet Explorer 6 on a server running PHP 5.2.5.
Also the Magic Quotes feature has been removed from PHP 6.0.0:
QUOTE
Warning
This feature has been DEPRECATED and REMOVED as of PHP 6.0.0. Relying on this feature is highly discouraged.
Best regards,
Reply
