开发者

Is it safe to unescape newlines and line breaks?

开发者 https://www.devze.com 2023-03-19 23:27 出处:网络
Is it safe to sanitize the input with mysql_real_escape_string and then unescape line-breaks? For example:

Is it safe to sanitize the input with mysql_real_escape_string and then unescape line-breaks? For example:

$to_database = mysql_real_escape_string($_POST['some_input']);
$to_database = str_replace('\n', "\n", $to_database);
$to_database = str_replace('\r', "\r"开发者_Python百科, $to_database);

I need this, because they spoil my markdown which is stored in database.


To unescape special characters like '\n' or '\r' you need use stripcslashes (not stripslashes) after pulling from database


There is no point in unescaping anything after the mysql_real_escape_string. If the data is not read correcly back, most likely magic quotes is turned on. In that case, you have to stripslashes before the escaping. (But do this only if magic quotes is turned on - you can check this at runtime)

0

精彩评论

暂无评论...
验证码 换一张
取 消