PHP urldecode - works in localhost but not from server
<p>I have been using urldecode to pick up a key or keys and complete a mysql query based on the keys sent through.</p>

<p>This works with out issue from localhost regardless of which browser is used.</p>

<pre><code>$selections = urldecode($_GET['keys']);

echo_To_File("../../_logs/log.txt", "selections : " . $selections );

$page_Number = !empty($_GET['page']) ? (int)$_GET['page'] : 1;

$rows_Per_Page = 1;

/*
 * get appropriate subset by qualifying record count
 */

$qualified_By = "WHERE user_Key in " . $selections;
$total_Records = User::record_Count($qualified_By);

$update_Pagination = new Pagination($page_Number, $rows_Per_Page, $total_Records);


$sql  = "SELECT * FROM User ";
$sql .= "WHERE user_Key in " . $selections;
$sql .= "ORDER BY last_Name ";
$sql .= "LIMIT " . $rows_Per_Page . " ";
$sql .= "OFFSET " . $update_Pagination-&gt;offset() . ";";

$User = User::find_By_Sql($sql);
</code></pre>

<p>From local host my log file reads</p>

<blockquote>
  <p>2012/11/25-10:40:29 => selections : ('73','71','54')</p>
</blockquote>

<p>Which is exactly  what I was looking for and the query is correct.</p>

<p>From the server my log file reads</p>

<blockquote>
  <p>2012/11/25-10:43:17 => selections : (\'73\',\'71\',\'54\')</p>
</blockquote>

<p>So obviously I get the following SQL syntax error.</p>

<blockquote>
  <p>(\'73\',\'71\',\'54\')Database query failed: You have an error in your
  SQL syntax; check the manual that corresponds to your MySQL server
  version for the right syntax to use near '\'73\',\'71\',\'54\')' at
  line 1</p>
  
  <p>Last SQL query: SELECT COUNT(*) FROM User WHERE user_Key in
  (\'73\',\'71\',\'54\')</p>
</blockquote>

<p>I have been back over the documentation <a href="http://php.net/manual/en/function.urldecode.php" rel="nofollow">here</a>  several times but I can't see where I am going wrong.</p>

<p>If anyone else has experienced this I would welcome any advice has to how to overcome it.</p>

<p><strong>EDIT:</strong></p>

<p>All the objects share a common database object. The constructor for the database object detects is magic quotes set:</p>

<pre><code>    private $connection;
    public $last_Query;
    private $magic_Quotes_Active;
    private $real_Escape_String_Exists;

  function __construct() {
        /* We will always open a connection when we create a database object */
        $this-&gt;open_Connection();
        $this-&gt;magic_Quotes_Active = get_magic_quotes_gpc();
        $this-&gt;real_Escape_String_Exists = function_exists( "mysql_real_escape_string" );
  }
</code></pre>

<p>Thereafter every query where values escaped:</p>

<pre><code>public function escape_Value( $value ) {
    if( $this-&gt;real_Escape_String_Exists ) { // PHP v4.3.0 or higher
        // undo any magic quote effects so mysql_real_escape_string can do the work
        if( $this-&gt;magic_Quotes_Active ) { $value = stripslashes( $value ); }
        $value = mysql_real_escape_string( $value );
    } else { // before PHP v4.3.0
        // if magic quotes aren't already on then add slashes manually
        if( !$this-&gt;magic_Quotes_Active ) { $value = addslashes( $value ); }
        // if magic quotes are active, then the slashes already exist
    }
    return $value;
}
</code></pre>
