JP Stones — Mon, 02 May 2005 22:49:49 +0000

thanks, was just gonna write that i'd figured out your last post. is the ENT-Quotes i had not been using as did not undertsand it

grrr

all sorted now at last - thanks

Busy — Mon, 02 May 2005 22:43:18 +0000

sorry,

replace addslashes($input_data) with htmlspecialchars($input_data, ENT_QUOTES) or htmlentities($input_data, ENT_QUOTES)

JP Stones — Mon, 02 May 2005 22:20:48 +0000

i cant see where i would put these to make it work Busy?

Busy — Sun, 01 May 2005 22:46:33 +0000

you could use htmlspecialchars($var, ENT_QUOTES) or if you want more characters transverted use htmlentities($var, ENT_QUOTES)

this is instead of addslashes and you wont need to use stripslashes as it converts the quotes - " = &quot ; ' = &#039 ; etc

JP Stones — Sun, 01 May 2005 17:47:09 +0000

ok more fiddling and I have it working for double quotes but still not for single quotes

its passing the variable through the previw phase that is the problem.

try running the script with a single quot ein it and it displays it fine in preview but cuts it on the hidden field so that it does not go through to the final stage.... ahhhhh

it would be great of someone could take a look for me

<?php
// display form if first time on page
                            
if ($_GET['stage'] == \"start\")
{
    echo \"Collect Data:<br>\";
    echo \"<form action='preview.php?stage=preview' method='post'>          
             <input name='form_field' type='text'>
             <input type='submit' value='Preview Entry' class='button'>
            </form>\";    
}

// display preview on submit

if (@$_GET['stage'] == \"preview\")
{
    $input_data = $_REQUEST['form_field'];
    if(get_magic_quotes_gpc()) 
    {
        $input_data = stripslashes($input_data);
    }

    echo \"Preview Data:<br><br>\";
    echo $input_data; 
        
    echo \"<br><form action='preview.php?stage=end' method='post'>
          <input type='text' name='form_field' value='$input_data'>
          <input type='submit' value='Add Entry'>
          </form>\";
}

// display confirmation page and submit to database
    
if ($_GET['stage'] == \"end\")
{
    $input_data = $_REQUEST['form_field']; 
    $input_data = addslashes($input_data);
    $query = \"insert into element (element) values ('$input_data')\";
    $result = mysql_query($query) or die (\"Couldn't execute query.\");
    echo \"Your text has been inserted into the database. <a href='preview.php?stage=show'>View</a>\"; 

}

if ($_GET['stage'] == \"show\")
{
    $query = \"select element from element\";
    $result = mysql_query($query) or die (\"Couldn't execute query.\");
    $row = mysql_fetch_array($result);
    $element = stripslashes($row['element']);
    echo $element;
}
?>

Busy — Tue, 26 Apr 2005 21:46:11 +0000

addslashes into the database
stripslashes from info out of database

You can reverse the quotes in the form variable: $form1 = '
I perfer this method so it can still be validated

aboyd — Tue, 26 Apr 2005 18:55:33 +0000

I hate to point you at a competing forum, but look at the second post here:

http://www.sitepoint.com/forums/showthread.php?t=257556

It has a perfect summary of the code used for each step. In particular, I think you want addslashes, not stripslashes. But review the example at Sitepoint.

-Tony