problem using str_replace

horstuff

Hi. Does anyone know why the code below only works if I comment out the two lines that have str_replace? I realize the whole code is not here, but it works fine if I don't use those two lines. So I hope it's just a simple thing with how I'm using it. I want to change ' to` because it breaks the query. When I go to the page that contains this code, it automatically enters blank data into the db. There is a text arae on the page, a standard form. Like I said, if i get rid of those two lines, everything is fine. But with them, it automatically enters into the db upon the page opening. So now there is a blank entry in the db for each time I have viewed the page. I haven't included the rest of the code because it is big and I thought this was simple, hopefully, but...?

$maw2= str_replace("'","`",$maw2);
                  $maw3 = str_replace("'","`",$maw3);
            $query = "INSERT INTO return (ar_tag,return_comment) VALUES (' $maw2','$maw3')";

sijis

I believe what you are trying to do is escape the ' character.

look into addslashes()
http://www.php.net/manual/en/function.addslashes.php

and stripslashes()
http://www.php.net/manual/en/function.stripslashes.php

quick use:

$maw2 = stripslashes($maw2); //escapes special characters, including the '
$query = "INSERT INTO return (ar_tag,return_comment) VALUES (' $maw2', ........)

reading the entry.

echo stripslashes($row['return_comment']); // should return text without slashes.

hope that helps.

horstuff

Got it. Thanks very much for your help. I combined your input with HTTP_POST_VARS, and it works great.

In case anyone wants to know, here it is:

if ($HTTP_POST_VARS['action'] == "addr" && $HTTP_POST_VARS['doaddr']==1) {
    $maw2= addslashes($HTTP_POST_VARS['maw2']);
    $maw3 = addslashes($HTTP_POST_VARS['maw3']);
    $query = "INSERT INTO return (ar_tag,return_comment) VALUES (' $maw2','$maw3')";