title: escape array values before insert statement in for each loop
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/3006407/slash-before-every-quote-problem">“slash before every quote” problem</a>  </p>
  </blockquote>
  
  
  
  <p>i have a weird situation where my code works when on the local computer as in localhost but when i publish it on the web server it behaves differently.</p>
  
  <p>i have a list of students with checkboxes along them so that the user can select checkboxes and after clicking on the remove button those are removed from the list meaning i insert them in a different table.</p>
  
  <p><strong>Note: the studentid is with slashes like KNC/2012/sem1/BSC/125</strong></p>
  
  <p>Now my javascript functions makes an ajax request and send the value as parameters to my php file which goes through the array and insert them using a foreach loop.</p>
  
  <p>javascript code:</p>
  
  <pre><code>function flagRemovedStudents(iar){
  displayBox = document.getElementById("studentBox");
  elements = document.getElementsByName('stids[]');  
  data = [];
  for (i = 0; i &lt; elements.length; i++){
   if (elements[i].checked){
      data.push('stids[]='+encodeURIComponent(elements[i].value));
   }
   }
   params = "iars="+encodeURIComponent(iar)+"&amp;fl="+encodeURIComponent(1)+"&amp;"+data.join('&amp;');
   alert(params); // just to check what values are being passed to php script
   if (window.XMLHttpRequest)
   {
   xmlhttp=new XMLHttpRequest();
   }
  else
   {
   xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
   }
  xmlhttp.onreadystatechange=function()
   {
  if (xmlhttp.readyState==4 &amp;&amp; xmlhttp.status==200)
   {
  result = xmlhttp.responseText;  
  alert(result);
  displayBox.className = "dimBox";
  setTimeout(function(){showStudentsAfterRemoval(iar);},200); 
  }
   }
  xmlhttp.open("POST","remst.php",true);
  xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
  xmlhttp.send(params);
  } 
  </code></pre>
  
  <p>now my php works as:</p>
  
  <pre><code> $session = $_SESSION['sess'];
   $iarsid = mysql_real_escape_string($_POST['iars']);
   $studentid = $_POST['stids'];
   $num = 0;
  
   foreach ($studentid as $value ) {
  $val = mysql_real_escape_string($value);
  $q1 = "insert into removedstudents(sessionid,iarsid,studentid)     values('$session','$iarsid','$value')";
  $r1 = mysql_query($q1) or die(mysql_error());
  if(mysql_affected_rows() &gt; 0){
  $num = $num + 1;
  }
    }
  echo $num." student(s) have been removed from the responsibility.";
  </code></pre>
  
  <p>Problem is that on the webserver the studentid is being inserted as <code>KNC\/2012\/sem1\/BSC\/125</code> which is affecting my further queries.</p>
  
  <p>Surprising part is that it is being inserted in the format i require on the localhost i.e. my development environment but it somehow behaves weirdly when i put the same code on the webserver.
  Please help.</p>