[Plugin: WP Customer Reviews] yet again, backslashes on comments and response fields

If you don’t have a large number of reviews you can always edit the review in the admin section and replace the apostrophe and quotations with html equivalents https://www.w3schools.com/tags/ref_ascii.asp

I’m sure you are looking for a more permanent solution so what I can add apart from this is that the problem seems to arise if you edit the review in the admin section.
When I submit reviews with apostrophes and don’t make any edit before approving I don’t see the slashes but if you make an edit to a submitted review the slashes are added.

Perhaps editing in the admin section adds a second slash to the entry in the database and the plugin only removes one when it outputs the data on the page? This could be fixed with a recursive stripslashes function perhaps?

Hi,

It does indeed only add slashes when editing through the backend.
Though I use the response field and can only edit that through the backend.

“recursive stripslashes function perhaps” – Yes, absolutely but I have no idea how to implement that.

I’ve just edited the slashes out through mysql for now, though it’s a pita and shouldn’t have to do that.

Ta
Danny

Ok my theory didn’t pan out but I think I’ve solved the issue. It does appear to be something to do with magic quotes. I’m no master coder so I don’t know the full consequences of this but you can add

if (get_magic_quotes_gpc()) {
    $process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
    while (list($key, $val) = each($process)) {
        foreach ($val as $k => $v) {
            unset($process[$key][$k]);
            if (is_array($v)) {
                $process[$key][stripslashes($k)] = $v;
                $process[] = &$process[$key][stripslashes($k)];
            } else {
                $process[$key][stripslashes($k)] = stripslashes($v);
            }
        }
    }
    unset($process);
}

to wp-customer-reviews/wp-customer-reviews-admin.php just after the opening

<?php

and that seems to resolve the issue. (Code thanks to https://docs.php.net/manual/en/security.magicquotes.disabling.php)

Cheers,
Matthew

Matthew,

Thanks for taking time out to resolve this issue, however, ive added the code where you said, just after the <?php and it doesn’t fix it for me!

Ive checked and double checked ive done it right, not that its difficult, and it still wont work…

Confused…

Hmmm I’m running it locally not sure if that will make a difference. It definitely resolved it for me. Did you add it to wp-customer-reviews-admin.php and not wp-customer-reviews.php?

Sure did;

[1035 lines of code moderated as per the Forum Rules. The maximum number of lines of code that you can post in these forums is ten lines. Please use the pastebin]

Hmmm, only other suggestion I have is to remove the if condition and see if that works
if (get_magic_quotes_gpc()) {} not sure why it would but worth a shot. What version of PHP are you running?

Hi,

You mean leave the above code in place in -admin.php and remove just the ‘if’ part so it processes the function regardless?

Php 5.x

Yes

Neither of these solutions worked for me.

i have the same problem.

i edited each Review to put ” ” around each review. i then removed the quotation marks because of all the back slashes, but now there are backslashes where any apostrophe marks are. i guess the only option is to delete each review (copy it) and re-enter (paste) them in…ARGH!!!

i only had a couple of pages, took me 25 minutes. glad that’s done. from now on before i approve any reviews, i’ll just add the quotation marks and then approve.

I’ve still got this issue too, I never fixed it.
But it adds slashes whenever I edit through admin backend,it doesn’t matter whether I do it before approval or not, still adds slashes.

Try this one.

on wp-customer-reviews-admin.php line 864 and 870

$update_val = mysql_real_escape_string($new_value);
$update_val = mysql_real_escape_string($val);

change to

$update_val = mysql_real_escape_string(stripslashes($new_value));
$update_val = mysql_real_escape_string(stripslashes($val));

I think it will work fine after the next review