Hello,
I'm building an interface to write and edit articles on a project I'm currently working on. Of course, I'm filtering the input and encoding special characters. The problem is, I think FuelPHP is encoding all chars going into the database regardless - so my blog titles end up as something along the lines of:
\'Hello World\' this is a blog title.
What would be the best solution?
Was there ever any resolution here?
I'm getting some odd behavior here also. I'm using PHP 5.4 with magic quotes setting off anyways.
If I forge() a new model data goes into db fine. However, if I then modify a parameter on the model and save() it all fields that had " in them in the database now get turned into & q u o t ; (sorry for spacing could get it to show up in forum)
FuelPHP's DB layer doesn't encode anything, so it must be something in your code.
Maybe your filtering and encoding? FuelPHP by default doesn't encode on input, to make sure nothing goes into the database altered, but encodes on output.
Sorry, encoding was the wrong term. It is escaping all special characters.
"Fuel also encodes the URI to prevent nasty surprises when using URI segments, and escapes everything going into the database." http://docs.fuelphp.com/general/security.html
Which is why all my special characters have a \ in front of them.
If you really need to turn off the automatic escaping of all characters, you could use DB::query() instead and place your own SQL statement there.
BTW, are you escaping your input data before using DB::insert() or DB::update()? If yes, It's unnecessary since FuelPHP does that job when using DB::insert() and DB::update();
Nope, I'm not escaping anything prior to that. It is only html entities and characters such as ' which get escaped to \'. Does Markdown for example, ignore all escaped characters when it is a parsing a string?
Quotes HAVE to be escaped, otherwise you can't get the data into the database.
Have you checked the magic quotes setting as Jelmer suggested, as it is the most likely cause?
Same as used by most people, including myself in most of my projects, and in our Depot project.
I've never seen this behaviour, and if it was FuelPHP code related, I guess this forum would be flooded with complaints.
So I settle for something local to your environment or your application. Question is what?
Can you setup a new environment, fresh FuelPHP install, and add a DB::insert() and DB::select() to the welcome controller, to rule out anything in your code?
Donate
