When you UPDATE or INSERT to a db-table your SQL breaks if there are ' apostrophies in the query. And this is solved if you replace ' apostrophies with '' double-apostrofies.
For example: $name = str_replace("'","''",$name);
But, instead of testing and replacing all elements individually I wrote this somewhat flaky function to handle the whole SQL statement.
function strip_apos($q) {
$q = str_replace("'","''",$q);
$q = str_replace("(''","('",$q);
$q = str_replace("= ''","= '",$q);
$q = str_replace("=''","='",$q);
$q = str_replace("'')","')",$q);
$q = str_replace("'',","',",$q);
$q = str_replace(",''",",'",$q);
return $q;
}
$query = strip_apos($query);
The wormhole in this function now is if you enter for example:
$name ="Peter,'Bengtsson";
(according to the function, ",'" is not being changed to ''.
Can you all help me improve this function so that we all can use it?
Comments? Bugs? Please report.
