The difference between php stripslashes and addslashes

The difference between php stripslashes and addslashes_PHP Tutorial

WBOY

Release： 2016-07-13 10:39:58

Original

1044 people have browsed it

When we write data to mysql, for example:

Copy code The code is as follows:

mysql_query("update table set `title`='kuhanzhu's blog'");

That would go wrong. Like asp, databases are allergic to single quotes. At this time, addslashes are the most valuable, and have the same function as asp's replace("‘",""","kuhanzhu's blog").

For the sake of security, PHP has introduced the function of magic_quotes_gpc = On, which can directly insert single quotes into the database without any processing. Then for Off, you need to consider the single quotes problem, rather than blindly trusting the operating environment.

When magic_quotes_gpc = On, the data processed using addslashes() will be saved in the database in the form of '. If it is output directly at this time, you will find that the There is more content that I am looking forward to, so stripslashes() appears, it can remove it (different from str_replace("", "",$Str)).

When magic_quotes_gpc = Off, the data processed using addslashes() will be saved in the database in the form of ', without the problems mentioned above, addslashes() It plays the role of inserting data without errors. If it is output directly at this time, the data will be normal. No need to use stripslashes() anymore.

addslashes() and stripslashes() are exactly the opposite. Direct memory: addslashes() adds one, stripslashes() removes one

So when should I use it?

Simply put:

When magic_quotes_gpc = On, the system will automatically handle issues such as single quotes. It doesn’t matter whether you use addslashes() and stripslashes(), but if you use addslashes() when adding data, you must display the data. stripslashes()

When magic_quotes_gpc = Off, the system will not handle issues such as single quotes, so you must use addslashes() when inserting data, and you do not need to use stripslashes() when displaying data.

Now that you have the analysis, what should you do when doing the program? According to the above two situations, we can get:

Regardless of whether magic_quotes_gpc is On or Off, we use addslashes() when adding data. When On, stripslashes() must be used, and when Off, stripslashes() cannot be used.

How to judge whether it is On or Off? Use get_magic_quotes_gpc().

Final example:

Copy code The code is as follows:

Code
//Submit data, Or variable preparation:
$Content=addslashes("This is data, whether there are single quotes or variables");
//Insert data into the database, code omitted
//Start displaying data
$Content="Data read from database";
if(get_magic_quotes_gpc()){
$Content=stripslashes($Content);
}
echo $Content;