Menu
Community /Pin to ProfileBookmark
@NogDogDec 30.2008 — #All I can figure is that either you are escaping the string twice somehow, or else you are directly using the escaped string in some manner other than a MySQL query. For instance, the following works fine for me:
It outputs:
But the following, using the escaped string directly rather than in a query, will show the escaped characters instead:
This output:
@NogDogDec 30.2008 — #Sounds like a case of double-escaping. The bind_param function does its own escaping, so if you are using a variable which has been processed by mysqli_real_escape_string and then running it through a bind_param, then you are escaping it twice. So any variable being bound should [I]not[/I] be escaped first.
mysqli_real_escape_string adds rn
This is fine for HTML as I can use nl2br() or str_replace() to display the new lines/carriage returns. The problem starts when a user logs in to edit data in a textarea, the formatting is lost and I get rn for every new line/carriage return used. For example, if the text is inserted as:
[QUOTE]
Hi.
How are you today?
How’s life?
When the user goes to edit the text in a <textarea>, it comes out as:
[QUOTE]
Hi.rnrnHow are you today?rnrnHow’s life?
Should I just not use “mysqli_real_escape_string” as I’m going to use prepared statements throughout my script or is there a way to solve this problem? I’ve searched google quite a bit and I haven’t found any solution to the problem. I would have thought it would have been quite a common problem for PHP newbies.
Sign in
to post a comment6 Comments(s) ↴
0
@NogDogDec 30.2008 — #All I can figure is that either you are escaping the string twice somehow, or else you are directly using the escaped string in some manner other than a MySQL query. For instance, the following works fine for me:[code=php]
<?php
$text = "This is a test.
It is only a test.
The end.";
$db = new mysqli('localhost', 'root', '######', 'test');
$text = mysql_real_escape_string($text);
$db->query("INSERT INTO example_table (sample_field) VALUES ('$text')");
$id = mysqli_insert_id($db);
$result = $db->query("SELECT * FROM example_table WHERE ID = $id");
$row = $result->fetch_assoc();
$text = $row['sample_field'];
echo "<pre>".$text."</pre>";
[/code]It outputs:
<i>
</i>This is a test.
It is only a test.
The end.
But the following, using the escaped string directly rather than in a query, will show the escaped characters instead:
[code=php]
<?php
$text = "This is a test.
It is only a test.
The end.";
$db = new mysqli('localhost', 'root', '######', 'test');
$text = mysql_real_escape_string($text);
echo "<pre>".$text."</pre>";
[/code]This output:
<i>
</i>This is a test.nnIt is only a test.nnThe end.
0
@NogDogDec 30.2008 — #Sounds like a case of double-escaping. The bind_param function does its own escaping, so if you are using a variable which has been processed by mysqli_real_escape_string and then running it through a bind_param, then you are escaping it twice. So any variable being bound should [I]not[/I] be escaped first.