转义出现在MySQL中的字符

Question

I'm moving an HTML form from development (localhost) to production and initial testing has identified a problem with escape characters appearing in the production MySQL database that dont appear in the localhost database.

I'm using mysql_real_escape_string to escape characters in the form processing file and in the localhost database these are saved correctly and all you see is the apostrophe or quote symbol.

Once moved to production however, the form still processes correctly, but the database record now has the backslash escape character in front of the apostrophe or quote symbol. When the record is printed the backlash appears and this won't be acceptable.

Nothing else appears to be different, except localhost and production are running different versions of MySQL (localhost is running 5.5.24-log and production is running 5.0.95-log). I have no control over the production version as it is managed by the ISP, so I'm hoping this isn't the problem.

Hopefully this makes sense? Any help greatly appreciated.

Answer 1

The solution to this is using stripslashes() before displaying the output

$text = "Don\'t use mysql_* and use mysqli or PDO instead";
echo stripslashes($text); // would echo it out without the backslash

As an alternative, you can start using prepared statements which is the best practice for dealing with user input and database, which would also save you the hussle of having to escape all quotes, and stripping the backslashes before displaying them.