#4 Error in handling char '

[dj28]

' (the single quote) cannot be handled by all versions
of php. Passing that char directly to mysql will throw
an error. This can be seen when trying to submit a
quote with a ' in it (eg. Saly's baby has a large head.)

The fix is trivial. Add the following line in index.php :

$qQUOTE = addslashes($qQUOTE);

to the added() function so that the code block looks
like this:

else{
$qQUOTE = $_POST['quote'];
$qQUOTE =
htmlspecialchars($qQUOTE);
$qQUOTE = addslashes($qQUOTE);
...
}

Thanks,

dj28@dj28.com

[Nobody/Anonymous]

Logged In: NO

sorry doesn't work for me

[Nobody/Anonymous]

Logged In: NO

it kinda works for me...

sometimes displays 's as \' instead of just '... but this is
preferable to it not working at all....

anyone wanna try to fix this?

[Nobody/Anonymous]

Logged In: NO

Don't use the addslashes fix - you're going to want to use
stripslashes() where ever you display a quote. Its kinda
tricky cause they need the slashes to sit in the DB.

Here's the workaround: (on a almost default install, should
work fine for most)

in output.php:

insert $result=stripslashes($result);
into QUOTE FORMAT so it looks like this:

##############
##QUOTE FORMAT
##############

function quote_format($sql, $qotw_check){ //
Displayed anywhere quotes are returned.
include('config.php');
global $qID;
$result = database_connect($sql);
$result=stripslashes($result); //gets rid of those ugly slashes

blah blah blah....
}

and then $qQUOTE = stripslashes($qQUOTE);
into the ADD QUOTE CONFIRMATION function, so it looks a
little somthing like this:

########################
##ADD QUOTE CONFIRMATION
########################

function add_quote_confirmation($qQUOTE){
include('config.php');
$qQUOTE = stripslashes($qQUOTE); //this keeps slashes out.
print <<<EOF
Thanks, your quote has been submitted.<br />

etc...
}

and lastly, if you're using a template (rash_output.php or
whatever)
you want to add $qQUOTE=stripslashes($qQUOTE); to ADD QUOTE
CONFIRMATION so it looks like this:

########################
##ADD QUOTE CONFIRMATION
########################

function add_quote_confirmation($qQUOTE){
include('config.php');
$qQUOTE=stripslashes($qQUOTE); //this keeps escape slashes
from showing up
?>
Thanks, your quote has been submitted.<br />
...
}

you get the idea. This has worked for me - hope it does the
same for you. enjoy.

[Marek Kubica]

Logged In: YES
user_id=872713

Yeah, the stripslashes fix work's for me great. Thanks.

[Goad]

Logged In: YES
user_id=1365964

this isnt working for me....ive tried both.

[Nobody/Anonymous]

Logged In: NO

I haven't thoroughly tested this, but so far, it lets me add
a quote and modify the news with apostrophes in the message.

In index.php, change htmlspecialchars($qQUOTE) in QUOTE
ADDED to htmlspecialchars($qQUOTE, ENT_QUOTES).

####################
QUOTE ADDED
?added at the end of a uri: The workhorse behind add(), it
takes the submission and puts it into the submit table.
####################
*/
function added()
{
setcookie ("Add_Quote_Cookie", "1",time()+$cookie_time);
function content()
{
include('config.php');
if ($_COOKIE['Add_Quote_Cookie'] == '1'){
echo $cookie_already_set;
}
else{
$qQUOTE = $_POST['quote'];
$qQUOTE = htmlspecialchars($qQUOTE,
ENT_QUOTES);
$sql = "INSERT INTO `" . $subtable .
"` ( `id` , `quote` ) VALUES ( '', '" . $qQUOTE . "' );";
database_connect($sql);
add_quote_confirmation($qQUOTE);
// output.php
}
}
template();
}

In the template you're using, do what the other anonymous
user said about adding the stripslashes function:

########################
##ADD QUOTE CONFIRMATION
########################

function add_quote_confirmation($qQUOTE){
include('config.php');
$qQUOTE=stripslashes($qQUOTE); //this keeps escape slashes
from showing up
?>
Thanks, your quote has been submitted.<br />
...
}

That should be it. I hope that helps everyone.