0

I installed xampp on localhost and insert data contain quote using this php code

$content    = htmlentities($_POST['content']);
$content_esc = mysql_real_escape_string($content);
$save = mysql_query("INSERT INTO tbl_post (title,content,date,publish) values('$title_esc','$content_esc','$date','$publish')");

The result on localhost website is

this is 'example data'

The row on database filled with this

this is "example data"

But using the same code to insert data the result from my hosting provider is different

this is \'example data\'

The row on database filled with this

this is \"example data\"

I test my website on localhost, insert post contain quote and it show on page correctly. Then i surprise when i upload on online hosting, insert post and the post page show '\' before the quote.

At this time i replace the '\' with nothing. How to insert the quote so it can show same result on local mysql database and online mysql database ? What is wrong, my php code or my mysql database ?

Improve this question
4
  • 1
    can you post the output of this query SHOW VARIABLES LIKE '%character_set%'; from localhost and online server
    – altmannmarcelo
    May 3, 2013 at 18:26
  • here the output pastebin.com/6BmwiuCa
    – Yusufmm
    May 3, 2013 at 18:44
  • Provide the result from this query from both servers SELECT character_set_name FROM information_schema.COLUMNS WHERE table_schema = "DATABASE" AND table_name = "tbl_post" AND column_name = "content"; Change table_schema = "DATABASE" to your database name
    – altmannmarcelo
    May 3, 2013 at 19:37
  • Please also run SHOW CREATE DATABASE dbname; for every database on the Local Server and the Remote Server.
    – RolandoMySQLDBA
    May 3, 2013 at 20:35

1 Answer 1

Reset to default
2

Looks PHP issue, I bet you have Magic Quotes turned off on local (good!) whereas your hosting privider has turned them on - http://www.php.net/manual/en/security.magicquotes.what.php. When they're turned on it's the same like if you'd write:

$content    = htmlentities(addslashes($_POST['content']) );//HERE: addslashes is basically the same like your mysql_real_escape_string() - this means contents of $_POST get escaped automatically
$content_esc = mysql_real_escape_string($content);
$save = mysql_query("INSERT INTO tbl_post (title,content,date,publish) values('$title_esc','$content_esc','$date','$publish')");

I also guess that next time you're better asking such a question on StackOverflow instead;)

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.