How do I display escaped characters?
I feel silly for asking such a rookie question, and I tried searching but all I could find are sources that show how to do the escaping, which is not what I'm asking.
I am using PDO to add stuff to a database. As a result stuff gets escaped. The problem is, when I display that stuff back to the user it gets displayed exactly as it is in the db. In other wor开发者_如何学JAVAds an escaped single quote displays as a left slash plus a single quote.
I could just run some sort of find/replace on all escaped character sequences but I am sure there most be a 'proper' way to do this. A way that remains secure (or improves security)
Then you're doing it wrong. SQL escaping is only done to properly insert into the database and not break SQL syntax, the values are stored in their unescaped form. Values only need to be escaped for their transition into the database, the values are never supposed to be altered permanently. Especially with PDO you shouldn't need any escaping at all.
Most likely you have magic quotes turned on, which causes double escapism. Please read this carefully: http://php.net/magic_quotes
use stripslashes
echo stripslashes($var);
http://php.net/manual/en/function.stripslashes.php
精彩评论