String question

Anon

I'll try to be as descriptive as possible.

I have an access data base that I've written a web front end for in php. It's working great thus far, but my only remaining problem is this:

When ever you subit a form with data to be inputed into the database, any field with an apostrophe (') results in an error.

Note the "atest's" as the first var.

Warning: SQL error: [Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression ''atest\'s','','','','','',No,'','','','','','','','','','','',1,2, 1, 5, 5, 5, 0, 0, 0, 0,'', '', '', '', '', '')'., SQL state 37000 in SQLExecDirect in C:\Inetpub\wwwroot\ntdata\add_server.php on line 117

Is there away to make this not choke when someone uses special characters like that?

Thanks in advance.

mrjam

PHP3:

$texttobeinserted = addslashes($texttobeinserted);

will make ' go \'

PHP4:

should do this automaticly. If you get slashes in the database, you can use stripslashes($var) prior to output, to get rid of them.

Might help.

// Thomasso

Anon

Your right, it is adding the \ automaticly already. But I'm not getting the slash in the database, cuz it's not adding it. The ' in the var is somehow messing up the sql query string.

Anon

Here is what my query string looks like (hope this looks ok)

$query = "INSERT INTO $servers_tbl (NetBIOS_Name, Application_Function, IP_Number, Subnet_Mask, NAT_IP_Number, NAT_Subnet_Mask,";
$query .="Using_DHCP,FQDN, MAC_Address, Workgroup_Domain, Video_card, NIC_mfg_model, System_BIOS,";
$query .="No_of_processors, Processor_type_speed, RAM, System_mfg_model, Ser_No, Server_type,";
$query .="Locations_ID, Classifications_ID, Net_Name_ID, OS_List_ID, SP_Rev_ID, ITO_Confirmation, MW_Confirmation, SysAdmiral_Confirmation, Legato_Confirmation,";
$query .="Primary_apps, Secondary_apps, Disk_systems, Notes, Activity_Events, Protocols)";

$query .= "values ('$netbiosname','$application','$ipnumber','$subnetmask','$natipnumber','$natsubnetmask',";
$query .= "$usingdhcp,'$fqdn','$macaddress','$workgroupdomain','$vidcard','$nicmfgmodel','$systembios',";
$query .= "'$nocpu','$cputypespeed','$ram','$sysmfgmodel','$serialno',$server_id,";
$query .= "$location_id, $class_id, $network_id, $os_id, $sp_id, $itoconf, $mwconf, $sysadmiralconf, $legatoconf,";
$query .= "'$primaryapps', '$secondaryapps', '$disksystems', '$notes', '$activity', '$protocols')";

$test = odbc_exec($cnx, $query);

mrjam

another aproach then hehe

Take the first $netbiosname as an example. Prior to insert it, try ereg_replace() ( or maybe str_replace() )

$netbiosname = ereg_replace("'","//'",$netbiosname)

...inserting //' instead of the /' from my earlier example. Just an idea. If still no go, sorry.