Problem with single quotes

Anon

Hello,

I am writing a news script that stores news items in a mysql database, and then posts those items on a html page.

I am using html forms for input, the problem I am running into is that if a user types a single quote (') the text will not go into the database. So, i added this line of code

$message = ereg_replace("'", "''",$message);

To double up on the quotes so they will post properly. This works for one message, if the next user tries and input a message with single quotes thatnew message will over write the old one, but the remaining news entries will not update (ie. push down off the screen)

It's hard to explain. Any ideas on what could be causing this?

Thanks in advance.

brandonschnell

use addslashes() for all user inputted data and stripslashes() before sending to the client.

http://www.php.net/manual/en/function.addslashes.php

its bad karma to allow users to overwrite info from other users. find another way.

Anon

No I was overwritting data,

This is a news addition script. It post this news on the main page, the additional news item the are already posted on the page get moved down.

Thanks for the tip.

Anon

I've tried the addslashes method, that give me the same results as if I did the ereg_replace statement in my first post.

Brandon Schnell wrote:

use addslashes() for all user inputted data and stripslashes() before sending to the client.

http://www.php.net/manual/en/function.addslashes.php

its bad karma to allow users to overwrite info from other users. find another way.

brandonschnell

the other half of the problem is don't allow users to add/delete/modify other users data. for news, have each user insert a new record into the database. then show on the web page the last 10 news articles by date from the database.

it sounds like you've got one record, and are using an UPDATE & concat(new_news, old_news).

otherwise post an example (including source code) so that we can have a look.