[playadeseville]

Hello, i am using SQL in my server
and i escape strings to prevent sql injections.

I had to display the escaped table, is there a way to hide the "\" symbol?

ex.

mysql_real_escape_string(string, string);

show_unescaped(string);

i tried with strdel but \ symbol gives me errors!!
help =)

[Vince]

If that symbol appears in your actual table then you did something wrong. Escaping is done only on special characters to prevent syntactical errors.

[icra]

Quote:

Originally Posted by Vince If that symbol appears in your actual table then you did something wrong. Escaping is done only on special characters to prevent syntactical errors.

Nope,

mysql_real_escape_string puts a \ before ', "escaping it". In this way, the query won't recognize it as the end of the argument.

Example:

string = "Hit 'Em Up"

mysql_real_escape_string(string, result);

result = "Hit \'Em Up"

I think he needs displaying "result" as string, but if he's reading it from the query he'll have only "result". This means he haves to remove "\" character.

You can easily do a command like:

Код:

mysql_real_unescape_string(string[], result[]) {
   if(strcmp("\",result)) {
     // ... removes \ from the string.
   }
}

I'm not sure "\" character can be read from strcmp.

[playadeseville]

thx guys now i've understand!!

[rt-2]

Quote:

Originally Posted by icra Nope, mysql_real_escape_string puts a \ before ', "escaping it". In this way, the query won't recognize it as the end of the argument. Example: string = "Hit 'Em Up" mysql_real_escape_string(string, result); result = "Hit \'Em Up" I think he needs displaying "result" as string, but if he's reading it from the query he'll have only "result". This means he haves to remove "\" character. You can easily do a command like: Код: mysql_real_unescape_string(string[], result[]) { if(strcmp("\",result)) { // ... removes \ from the string. } } I'm not sure "\" character can be read from strcmp.

You need to use:

Код:

mysql_real_unescape_string(string[], result[]) {
   if(strcmp("\\",result)) {
     // ... replace "\\" with "\\\\"
   }
}