PHP email script -- problem with escaped quotes.

[sirbrent]

hello.

I have just written a script that takes form data and sends it as an email, pretty basic stuff.

the problem i am having is with escaped quotes. I found a nice little function to remove slashes (unescape) from REQUEST data...



function stripFormSlashes($arr) {
if (!is_array($arr)) {
return stripslashes($arr);
} else {
return array_map('stripFormSlashes', $arr);
}
}

if (get_magic_quotes_gpc()) {
$_REQUEST = stripFormSlashes($_REQUEST);
}


but the problem is that it doesnt play nice when it returns data to an html input (for example if they forgot to fill out a field, or email validation failed)--it effectively breaks the html.

I was hoping someone knew where i could find a function to find /" (escaped quotes) in REQUEST data and replace them with ".

Thanks for taking the time to look over my post.

[linFox]

Strip the slashes from the data (with that function), then htmlspecialchars() it, which encodes the characters that would cause problems (&, ", < and >).

[sirbrent]

thanks for the advice. should it look like this???


function stripFormSlashes($arr) {
if (!is_array($arr)) {
return stripslashes($arr);
} else {
return array_map('stripFormSlashes', $arr);
}
}

if (get_magic_quotes_gpc()) {
$request1 = stripFormSlashes($_REQUEST);
$_REQUEST = htmlspecialchars($request1, ENT_COMPAT);

}

[linFox]

try $_REQUEST = array_map("htmlspecialchars", $request1); instead on the last line.