Escape character

Anon

I am using SELECT * FROM dbname WHERE name='$somename' in php code. But when $somename=O'Neil it gives me a warning. I then used $somename=str_replace("'","\'",$somenmae) before the query it didn't work either. Does anyone know how to solve the problem?

Thanks

Zhen

Anon

You could use

SELECT * FROM dbname WHERE name="$somename"

hope this works

rrijnders

$sql = "SELECT * FROM dbname WHERE name='" . addslashes($somename) . "'";

Anon

But it didn't work. Because I need to write like this:
$curtopic= odbc_exec( $cnx, "SELECT * From dbname where name='$name'" );
There alreay are " " existing I can't use them around $name, like"$name".
Any other solutions?

Thanks

Zhen

Anon

It gave the warning anyway.

Warning: SQL error: [Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'topics.name='Kathleen M. O\'Neil, M.D.''., SQL state 37000 in SQLExecDirect in C:\Program Files\Apache Group\Apache2\htdocs\speaker\outputdb.php on line 247
Error in odbc_exec( no cursor returned )

Any suggestions?

Thanks
Zhen

rrijnders

Post the code that generates the sql. I think the problem is further down than the "O'Neil"; towards the end you have two single quotes and a trailing period that may be causing the error...

Anon

' is used as escape character in SQL

$somename=str_replace("'","''",$somenmae);

Anon

But the result will show two ' though, like O''Neil. How could I solve this problem?

Thanks
Zhen

Anon

Here is the code.
$name = ereg_replace ("'", "''", $name);
$sql = "SELECT * from dbname where name='$name'";
$curtopic= odbc_exec( $cnx, $sql );
echo "<font face=\"Arial\" size=\"1\"><b>".$name."</b>";

I don't see any reason why the result showed two single quotes, like O''Neil.

Thanks