backslashes added to quotes when reading from form

From: paul (paul_at_not.net)
Date: 11/30/04 

Date: Tue, 30 Nov 2004 09:41:34 -0800

The following code reads user input from a textbox on a form and writes
it to a text file:

         # extract comments from input box to text file
         $handle = fopen ("$basename.txt", "w+");
         fwrite ($handle, $_POST["comment"]);
         fclose ($handle);

If the text includes a single or double quote, it gets a backslash added
automatically in this process. I think this is some kind of security
measure but this only runs at home so I'm not worried about hackers.
Suprisingly though, my web hosting service does allow me to run it
publicly, so I probably should be aware of how to strip malicious code
from such input as it would be nice to allow visitors to leave comments
as well.

Thanks!

Relevant Pages

  • Re: DateTime Hell
    ... The textbox that gets the user input defaults to the system date unless I ... clone the date from the date time picker and either add or subtract the ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Textbox Locked property
    ... A standard TextBox with the Locked property set to True CAN be ... It also automatically selects the text contents when the control gets focus, ... Since not all user input involves editing (i.e. sometimes just ...
    (microsoft.public.vb.general.discussion)
  • asp.net Dynamic display Validator bug!!
    ... i have a asp.net Form with serval input textbox and serval validators to ... validate the user input dynamic ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: asp.net Dynamic display Validator bug!!
    ... > i have a asp.net Form with serval input textbox and serval validators to ... > when user input wrongly in the textbox, the validator will worn the user ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Textbox Locked property
    ... The Locked textbox isn't "disabled". ... It allows tooltips to display, ... Since not all user input involves editing (i.e. sometimes just ... modifying, no mouseover indication, no events reacting. ...
    (microsoft.public.vb.general.discussion)