[RESOLVED] mysql_real_escape_string problem

**kzatu** · Jan 29th, 2008, 12:02 PM

I am having a problem when a user submits specific text to my database. If the user types a UNC path to a server and the server starts with an 'R' then the data is malformed as it gets entered into the mySQL database.

For example, if the user types

\\realtime\sharename

I submit the data to the database using the mysql_real_escape_string. Which changes the data to now read

\\\r\nealtime\\sharename

This causes a problem when pulling the data out of the database and displaying it because of that \r\n. It does some tricky formatting and then the data printed in HTML looks like

\ ealtime\sharename

Any help on this?

**visualAd** · Jan 30th, 2008, 04:02 AM

This could be a bug. What happens if the path starts with \\n?

**kzatu** · Jan 30th, 2008, 10:29 AM

I just tried your suggestion and it does the same thing. I typed

\\name\share

and it replaced it with

\\\r\name\share

and when I pull it out of the database and print it, it looks like

\ ame\share

**penagate** · Jan 30th, 2008, 11:04 AM

Show us some code: specifically, everything that happens to the value "\\name\share" after the user submits it.

Escaping \r and \n characters is documented behaviour for this function but it should not be replacing literal \r with literal \r\n. There must either be some other issue with how you are handling the submitted data or the function is buggy.

**kzatu** · Jan 30th, 2008, 01:16 PM

Hmm. I was trimming the excess fat off of my code so that I could show you the bare essentials of what my code is doing when I stumbled upon a discovery. The problem appears to lie with TinyMCE which is something that I just installed and deployed a few weeks ago.

So here is the code in its simplest form with its suspected bug.

Code:

<?php
  $newcontent=$_POST['newcontent'];
  echo $newcontent;
?>
<HTML>
  <head>
    <script language="javascript" type="text/javascript" src="tinymce/jscripts/tiny_mce/tiny_mce.js"></script>
    <script language="javascript" type="text/javascript">
      tinyMCE.init({
        mode : "textareas",
        theme : "simple"
      });
    </script>
  </head>
  <form method="post" action="test.php">
    <textarea name="newcontent" id="newcontent"><?php echo $newcontent ?></textarea>
    <input class="button" type="submit" name="submit" value="Submit">
  </form>
</html>

You can actually go to the live example on TinyMCE's page and witness this bug for yourself at http://tinymce.moxiecode.com/example...p?example=true

And this appears to be reported as a bug, here http://sourceforge.net/tracker/index...81&atid=635682

Also, I'll go ahead and mark this thread as closed, but if you want to add something, please do.

Thread: [RESOLVED] mysql_real_escape_string problem

Thread Tools

Display

[RESOLVED] mysql_real_escape_string problem

Re: mysql_real_escape_string problem

Re: mysql_real_escape_string problem

Re: mysql_real_escape_string problem

Re: mysql_real_escape_string problem

Posting Permissions