I have been trying to sanitize user input for saving safely in the database and then redisplaying.  If a user enters something like M'Cain for the name, how should I sanitize it before sending to the database, and then when reading back, deal with it so that it displays correctly.  Currently I am using sanitize_text_field which adds the \ before the apostrophe, but this then displays when I display it back.   Do I simply use strip_slashes before outputing back to the screen or another function?
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
35886
Code is supposed to be exact and "as-is". Sometimes, showing two spaces is important. In a comment, it is not possible to show code with  multiple   spaces. This became apparent in  (see comments).  EDIT: apparently this bug is larger then I thought: multiple    spaces   here are neither preserved in normal question text. Pity (though I couldn't find this reported before, I'd assume it is).  Workaround: use Alt+0160 (windows), or U+00A0 (Unicode NBSP), as I did in the example above.
48211
Im using smarty and mysql_real_escape_string() for user input, and when I insert some code with ' or " , and lookup in phpmyadmin it shows without backslashes.  When I get record from DB i doesn't have backslashes also. But when I just pass escaped string without inserting into the db it is backslashed.  Shouldn't it add slashes, insert with them and then I would  strip them when i would output? Or am I missing something?
39060
Whenever I try to insert " or ' I have to validate it by space, otherwise strange things happen as with ' followed by an a becomes áinstead of just 'a, similar behaviour with double quotes. I find this annoying and want to disable it. How do I do that?
122159
Is there a way to have a statement across multiple lines without the underscore character?  It is really annoying in multi-line strings such as SQL statements, and especially  queries.  Beside from the ugliness and difficulty when changing a line (nothing lines up anymore), you can't use comments in the middle of the multi-line statement.  Examples of my daily personal hell.  dim results = from a in articles _               where a.articleID = 4 _ ' articleID     - Nope, can't do this               select a.articleName   dim createArticle as string = _     "Create table article " &amp; _     "    (articleID int " &amp; _     "    ,articleName varchar(50) " &amp; _     "    )"
20766
User equals untrustworthy. Never trust untrustworthy user's input. I get that. However, I am wondering when the best time to sanitize input is. For example, do you blindly store user input and then sanitize it whenever it is accessed/used, or do you sanitize the input immediately and then store this "cleaned" version? Maybe there are also some other approaches I haven't though of in addition to these. I am leaning more towards the first method, because any data that came from user input must still be approached cautiously, where the "cleaned" data might still unknowingly or accidentally be dangerous. Either way, what method do people think is best, and for what reasons?
114332
I have the problem, that PHP replaces all spaces with underscores in POST and GET variables. For example if I have the URL: http://localhost/proxy.php?user name=Max the browser will convert it to http://localhost/proxy.php?user%20name=Max. But if I give the $_GET parameters out, the key is not user name but user_name (note the underscore)! Is there any possibility to change this behaviour?
76453
I'm reading a field value and its format from the database. How would I render that value with the format?
4554
How do I post text so that it is formatted as code?  What do I need to do so that my code shows up properly &mdash; not escaped or removed &mdash; when posted? And how to get the correct syntax highlighting?     For more information, see "" in the .
10708
Some questions, for example    Instead of using a correct URL, such as  http://meta.stackexchange.com/questions/79543/٩●̮̮̃-̃۶-forbid-unicode   are using  https://superuser.com/questions/516363/what-is-the-��-character   What is causing this behavior?
13695
If I try to put something like this into a question or answer  &lt;!-- &lt;br&gt;s are important here --&gt;   the first &gt; after the "br" is matched to the first &lt; before the "!--", resulting in this being displayed:     s are important here -->   This happens in both previews and actual posts. I'd say it's a bug.  HTML comments shouldn't be treated as regular HTML tags; &lt;!-- should only be matched to --&gt;.
120219
When I do   str="Hello World\n===========\n"   I get the \n printed out too. How can I have newlines then?
41679
I'm trying to write a single backslash in a comment as code formatted by backtick. Like this:  `\`   but it escapes the backtick and doesn't close the "inline code block".  I've read  but couldn't figure out.  How do I format a single backslash in comment as code?
117376
My php is weak and I'm trying to change this string:  http://www.example.com/backend.php?/c=crud&amp;m=index&amp;t=care                                    ^   to be:  http://www.example.com/backend.php?c=crud&amp;m=index&amp;t=care                                   ^   removing the / after the backend.php?. Any ideas on the best way to do this?  Thanks!
66745
I'm using the Message module on Drupal 7.  For Replacement tokens, the help text says:     A comma-separated list of replacement tokens, e.g. %title or !url, of   which the message text makes use of. Each replacement token has to   start with one of the special characters "@", "%" or "!". This   character controls the sanitization method used, analogously to the   t() function.   What's the difference between %, !, and @?  Are there standards about when I should use each symbol?
40781
While appending some text after a matched pattern, I wanted to add an empty line with a comment to isolate my additions from the rest. However, I have noticed that for the very first \n, I need to escape the \ with an additional \ (makes it \\n) but this is apparently not required for rest of the appended text. Why is this so?  An example that I produced on a SUSE 11 server (bash v3.2.57(2) and GNU sed version 4.1.5) is:  edwdev@hdpedge1:/edw&gt; sed '/test/a \\nNot a test\nJust Playing' &lt;&lt;&lt; test test  Not a test Just Playing   If I do not escape the first \n (right after the a sed command, I get an n printed instead of a newline.  edwdev@hdpedge1:/edw&gt; sed '/test/a \nNot a test\nJust Playing' &lt;&lt;&lt; test test nNot a test Just Playing   Notice that I have intentionally added a space after a command so that it doesn't conflict accidentally with alternate syntax.  Same behavior is observed if I replace \n with \t.Number of spaces after a command do not seem to matter; the first backslash needs to be escaped to print the special character even after multiple spaces.    Same is the case on another environment, where I originally observed this; a Centos 7 x64 VM, bash version is 4.2.46(2) and sed version is GNU sed 4.2.2  sed -i '/\[mysqld\]/a \\n# &lt;&lt;INSERTED MANUALLY&gt;&gt;\ntransaction-isolation=READ-COMMITTED\ninnodb_flush_method=O_DIRECT\nmax_connections=550\n# &lt;&lt;END OF MANUAL INSERTIONS &gt;&gt;\n' /etc/my.cnf   Output:  ... [mysqld]  # &lt;&lt;INSERTED MANUALLY&gt;&gt; transaction-isolation=READ-COMMITTED innodb_flush_method=O_DIRECT max_connections=550 # &lt;&lt;END OF MANUAL INSERTIONS &gt;&gt;  ...   Output Without Escaping first \n:  [mysqld] n# &lt;&lt;INSERTED MANUALLY&gt;&gt; transaction-isolation=READ-COMMITTED innodb_flush_method=O_DIRECT max_connections=550 # &lt;&lt;END OF MANUAL INSERTIONS &gt;&gt;   Is there any particular reason for this behavior? I am unable to find any details while skimming through the docs (), through, admittedly, I haven't read the entire documentation thoroughly.
50152
Consider the following text (incidentally, part of a MySQL dump):   CREATE TABLE `table` (   `id` int(10) NOT NULL auto_increment,   `name` varchar(100) NOT NULL default '',   `description` text NOT NULL,   PRIMARY KEY  (`id`),   FULLTEXT KEY `full_index` (`name`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1; /*!40101 SET character_set_client = @saved_cs_client */;   I would like to remove the FULLTEXT key, and I also want to remove the trailing comma on the line above so that the SQL remains valid.  Can anyone come up with (and explain) a sed recipe to do this?