how to prevent error of " ' " when input text?

valen53

somethin like when we key in " didn't " in the textfield. how to prevent
" ' " occur error ? i just know add \ before ' . but when we insert data, how we know user will type ' ? any method can be prevent it ?

jonathen

Best thing to do is ensure the user CAN enter the ' symbol without it generating any errors. You can tell the script to automatically insert the \ operator before ' so that you do not get any errors, using addslashes()

i.e, let's say the the name of the textarea is called "text" and is defined later as $text (for submitting to db for example), you would simply replace $text with addslashes($text)

That's what I do anyway...

Jonathen

valen53

i still facing addslashes problem
below is the name i select. and the error msg.

addslashes($row[name]) ;

S\' Pantile ---- from DB.

Warning: mssql_query() [function.mssql-query]: message: Line 2: Incorrect syntax near 'Pantile'. (severity 15) in C:\Apache Group\Apache\htdocs\leave\Leave_method.php on line 157

Warning: mssql_query() [function.mssql-query]: message: Unclosed quotation mark before the character string ')'. (severity 15) in C:\Apache Group\Apache\htdocs\leave\Leave_method.php on line 157

the task i want to do are i want select name from Db then insert into another table. but when insert, the error was occur. no matter i use stripslashes or addslashes, the problem stillcome out.
anyone can help me ??

Daveyz1983

The recommended addslashes and stripslashes are for your data. You addslashes wadever u recieve from the text field before putting it in the database using insert into table values('$blabla');

Its not for ur mysql query.

in your sql query u still use ur single quote. mysql_query("this is a sql statement where columnname='value'");

valen53

addslashes(), it still cannot work...

$name = abc' efg ;
after addslashes($name)
i echo the $name are abc\ efg
but still cannot insert to DB, i really dunno which part occur error.
i use mssql 2000. varchar .

any part need to changing ?? or change configure php.ini?

Daveyz1983

Mind showing us ur php codes for data insertion?

valen53

$query = "select * from Pop" ;

$result = mssql_query($query);
while($row = mssql_fetch_array($result))
{
$name = addslashes($row[name]) ;

echo $name;

$insert = mssql_query("insert into undersupers(name)values('$name')");
}

the actual data is P'slide,
when echo $name is P\'slide,
then error msg, cannot insert into table...
so any

Daveyz1983

add a space before ur values? try?

jassh

ermm.. correct me if i'm wrong..

but are you actually addslashes the data
retrieved from a database?

if i'm not misataken, if the data is allready in the database, then it probably dont have to be adslashed,
coz if it has ' in the first place, it wouldnt be in the db, right?
(unless you manually enter it without using query, eg, to mssql directly)

you only addslashes new data you wanna insert to the db..

jassh

valen53

Originally posted by Daveyz1983
add a space before ur values? try?

$name = addslashes($row[name]) ;

echo $name;

$insert = mssql_query("insert into undersupers(name)values('$name')");

u mean where? i try already but still cannot. have u try it?