Single Quote(') fails on Insert and NOT on Update

Anon

I have a problem regarding the Single quote in free text of the form, while saving in the db, the Insert fails but Update has no problem. Why is it so ?

e.g.
This fails if a record has a single record

$insert_games = "Insert into gameinfo " ;
$insert_games .= "Values " ;
$insert_games .= "'$new_number','$grecord[1]', " ;
$insert_games .= " '$game_record[2]','$game_record[3]') " ;

This is successful if Single or Double quotes are there in free text form.

$update_sql = " Update help_pages " ;
$update_sql .= " set help_params = '$help_params', " ;
$update_sql .= " help_group = '$help_group', " ;
$update_sql .= " help_subgroup = '$help_subgroup, " ;
$update_sql .= " help_shortdesc = '$help_shortdesc' ...

Any idea why is it so ?
Thanks in advance.

Bijal.

Anon

the reson i think that it fails is that the string you are inserting contains one or more '... do an addslashes($str); on all the var's you want to insert.. that should do the trick

Andreas

Anon

because IIRC you can only use plain variables (ie: not array elements) in strings without catting them together.

try

$insert_games .= "'".$new_number."','".$grecord[1]."', " ;

--
rad

Anon

Yup,

The solution is not the best work around, but might help. The single quotes ends any insert query irrespective of adding slashes. Database doesnt treat slash before the single quote as a mask, but a character. Hence you will need to replace it with someother char and store into the db and change again when printing.

eg:
ereg_replace("'", "quotes3242", $str); // when storing
and ereg_replace("quotes3242", "'", $str); // when printing.

the reason why this unusual string "quotes3242", is for ensuring that it does not clash with any other string you might store in the Database.

Hope this helps.