I have a function I use when I'm inserting snippets of code into a MySQL database:
function mysql_safe_data($string) {
$string = stripslashes($string);
$string = str_replace("'", "''", $string);
$string = str_replace("\\", "\\\\", $string);
return $string;
}
If you don't replace \\ with \\\\ you're going to have problems with slashes when you insert them into MySQL. Just try inserting this code that highlights text into MySQL through an HTML form and see what I mean.
function highlight($string, $words_to_highlight, $delimiter=" ", $case=0,
$left_string="<b span style=\"background-color: yellow;\">", $right_string="</b>") {
// This is so it highlights the first word. Each word in a textblock must be surrounded by
// [^A-Za-z] in order to highlight whole words, and not subwords.
/* Filtering Process:
Replace statements take out all malicious chars that would break the
search part of a regular expression. Takes unwanted chars and only lets the chars:
[^-a-zA-Z0-9&] in. */
$list_of_words = eregi_replace("[^-a-zA-Z0-9&']", " ", $words_to_highlight);
// This portion of code is to take out single word characters.
$list_array = explode(" ", $list_of_words);
for($i=0; $i<sizeof($list_array); $i++)
if(strlen($list_array[$i]) == 1)
$list_array[$i] = "";
$list_of_words = implode(" ", $list_array); // Use space as delimiter
$list_of_words = eregi_replace(" +", "|", $list_of_words);
// Make sure there aren't any pipes | around $list_of_words
if($list_of_words{0}=="|")
$list_of_words{0} = "";
if($list_of_words{strlen($list_of_words)-1}=="|")
$list_of_words{strlen($list_of_words)-1}="";
$list_of_words = "(".trim($list_of_words).")";
if($case==0)
return eregi_replace("$list_of_words", "$left_string"."\\1"."$right_string", $string);
else
return ereg_replace("$list_of_words", "$left_string"."\\1"."$right_string", $string);
} // end function highlight
samaru
a.k.a inscissor
1,256 posts since Feb 2002
Reputation Points: 262
Solved Threads: 18
Skill Endorsements: 22