mysql - Replacing with PHP

Question

I have a post form, which inserts my text in a MySQL database.

I use

$post_text = mysql_real_escape_string(htmlspecialchars($_POST['text']));

and want to replace the which was automatically added.

I tried

$text = str_replace('\r\n','', $text);
$text = str_replace('
','', $text);
$text = str_replace('\R\N','', $text);
$text = str_replace('RN','', $text);
$text = str_replace('/
\n','', $text);
$text = str_replace('/r/n','', $text);
$text = str_replace('/R\N','', $text);
$text = str_replace('/R/N','', $text);

but is always included in my database entries.

How can I fix this?

Answer 1

The main problem you have with all the variations you've tried is that both and are escape characters that are only escaped when you use them in a double-quoted string.

In PHP, there is a big difference between ' ' and " ". Note the single-quotes in the first, and double-quotes in the second.

So: ' ' will result in a four character string containing a slash, an 'r', another slash and an 'n', whereas " " will contain two characters, those being the new line and carriage return characters.

So the direct answer to your question is that you need to use the second of the examples you gave in the question, but with double quotes instead of single quotes:

$text = str_replace("
",'', $text);

It's worth pointing out that this will remove all new lines from the input, and replace them with nothing. If there is more than one new line in the input, they will all be removed. Without knowing more about your application, I don't know if this is what you want, but here are some thoughts:

• If you only want to remove blank lines (and other white space) from the end of the input string, you can use the trim() function instead.

• If you want to retain the formatting for output to HTML, then the nl2br() function will help you. If you want to output to HTML without the formatting, then you may not need to remove them, as the browser will not render line breaks from characters.

• If you replace new lines with nothing, as per your example, the last word of the first line will now run directly into the first word of the second line, and so on. You may prefer to replace them with a space character rather than nothing.

• It is possible that users may submit the input with only without the matching , or vice-versa (this may be due to their OS or browser, or a deliberate hack, or a number of other reasons). If you want to replace all instances of both these characters, a more reliable way to do it would be to replace them individually, rather than relying on them being next to one-another. str_replace() allows you to do this by specifying them in an array. You can also use strtr() or preg_replace() to achieve the same goal.

Hope that helps.