backslash in php and mysql

Question

I have a question about backslash in MySql and PHP! I write a simple code for testing!

include "src/db.inc.php";
$name="licon's";
$name=addslashes($name);
$sql="insert into test values('$name')";
mysql_query($sql);
$sql1="select * from test";
$rs=mysql_query($sql1);
$row=mysql_fetch_assoc($rs);
echo $row['name'];

as the code displays, I want to insert a string with a single quote into an table.

1.I need to escape the string, here I use the function addslashes(). so the $name will be something like this "licon\'s".

2.but when I insert into $name into the table and I select it in mysql console, the backslashes added by the function addslashes disappear. just as the following:

mysql> select * from test;
+---------+
| name    |
+---------+
| licon's |
+---------+

3.when I select the field 'name' in PHP script and print it, the backslash also disappears.
as the following:

$sql1="select * from test";
$rs=mysql_query($sql1);
$row=mysql_fetch_assoc($rs);
echo $row['name'];
======
print: licon's

so I want to know the function addslashes() add a backslash in the variable $name. why the backslash disappear?

The main functionality of the `addslashes()` is for escaping the input. — Shankar Narayana Damodaran, Jan 21 '14 at 07:11
I know the functionality of the addslashes().but I want to know when select this in PHP,why I don't need to use stripslashes() — ChainWay, Jan 21 '14 at 07:13
@ShankarDamodaran but before I insert it into mysql,I use addslashes()! — ChainWay, Jan 21 '14 at 07:15
The backslash is required by MySQL to form a proper [MySQL string literal](http://dev.mysql.com/doc/refman/5.7/en/string-literals.html). — Gumbo, Jan 21 '14 at 07:19
“Within a string, certain sequences have special meaning […] Each of these sequences begins with a backslash (```\```), known as the *escape character*. MySQL recognizes the escape sequences shown in Table 9.1, ‘[Special Character Escape Sequences](http://dev.mysql.com/doc/refman/5.7/en/string-literals.html#character-escape-sequences)’.” — Gumbo, Jan 21 '14 at 07:24

score 1 · Answer 1 · edited Jan 21 '14 at 07:17

1

If you are using MySQL then use mysql_real_escape_string($name) or use mysqli_real_escape_string($connection,$name) if you are using MySQLi to get the clean input to store in the MySQL database.

edited Jan 21 '14 at 07:17

Hanky Panky

46,730
8
72
95

answered Jan 21 '14 at 07:15

Thompson

1,954
10
33
58

2

this is not the point!even I use mysql_real_escape_string($name),the backslashe will still disappear when I select it from mysql!I just want to know why I do not need to use stripslashes! – ChainWay Jan 21 '14 at 07:18
1

THIS IS THE ONLY POINT – Strawberry Jan 21 '14 at 07:28

Abhik Chakraborty · Accepted Answer · 2014-01-21T07:34:13.540

addslashes() and stripslashes() are some old way of manipulating the quotes into and from DB.

The reason is old PHP versions has magic_quotes_gpc() which is on by default on and this would do the following for Get/Post/Cookie operations.

When magic_quotes are on, all ' (single-quote), " (double quote), \ (backslash) are escaped with a backslash automatically

Now while you need to echo it would require stripslashes()

The new PHP and mysql does not need that at all and mysql is pretty good to handle your quotes and special charters so the best thing to use is mysql_real_escape_string() or equivalent mysqli_ functions.

And more importantly This feature has been DEPRECATED as of PHP 5.3.0 so probably its doing nothing as you are doing addslashes()

No, addslashes adds slashes to the data that you're sending to MySQL, but MySQL removes them before storing the data in the database. MySQL interprets \' as a piece of data, while interpreting a single ' as part of the SQL statement syntax.

tudouya, You should have described this earlier that what you want to know exactly. — Thompson, Jan 21 '14 at 07:34
@tudouya read the complete answer before you come to a conclusion that this is not the point and all. — Abhik Chakraborty, Jan 21 '14 at 07:36
I am sorry for my careless!I read your update comment!it solves my question!sorry again!the reputation to you! — ChainWay, Jan 21 '14 at 07:40

backslash in php and mysql

2 Answers2