Can't update with TEXT field

[foofoobar]

I'm trying to do a single field insert/update from a website to a DB.

It has been working off and on and I am having problems with a 255 char limit (which I thought using TEXT data type would have solved this as well as using the POST method) and I'm also having problems with the text sent.

I've tried addslashes() to take care of the problem but I end up with a whole SLEW of slashes in the file. And now trying an UPDATE on it via the website doesn't work for some reason.

Here is the code I am having a problem with and as far as text goes, you can insert anything>

<?php
$sec_id=$HTTP_POST_VARS['sec_id'];
$loc=$HTTP_POST_VARS['loc'];
$sec=$HTTP_POST_VARS['sec'];
$type=$HTTP_POST_VARS['type'];
$text=$HTTP_POST_VARS['text'];
$new=$HTTP_POST_VARS['new'];

$text=addslashes($text);

include ("../mySQL.php");

$DB = new sql_driver;
$DB->connect();

if(empty($sec_id)){
$DB->query("insert into section values('','".$loc."','".$sec."','".$type."','".$text."');");
}else{
$DB->query("update section set text=\"".$text."\" where sec_id='".$sec_id."';");
}

?>

If anyone can spot whats wrong here I would greatly appreciate a heads up.

[Sxooter]

OK, first off, you HAVE TO ESCAPE text to put it into a database, or else ' characters and such will screw you up. Use stripslashes to remove the slashes.

If you are limited to 255 characters, take a closer look at your table definition, you may have accidentally created a 255 character field instead of something larger.

Can we see the schema of your table?

[foofoobar]

I know about stripslashes and have implemented that but the problem is getting a query that reads like text with lots of single and double quotes all throughout to UPDATE.

The schema is very simple but for this table in particular, the columns are:

| sec_id int(5)| | PRI | NULL | auto_increment |
| loc_id int(5)| YES | | NULL | |
| section varchar(30)|
| type enum('notes','body','details') | | | notes

| text text

[Sxooter]

Well, you got me. I don't see any obvious errors with your table definition.

Have you tried inserting >255 characters by hand in the mysql monitor?

[foofoobar]

Heh... oh yeah. From a command line prompt if I try more than 255 it gets funky. It's chops it at 255

[foofoobar]

Ok figured it out. For one, I HAVE TO ESCAPE TEXT,... heh. Eloquently put. Second, if magic_quotes_gpc is on, you DON'T have to addslashes() when submitting via a web form.

I think those were my only problems. Wierd escpae characters were being generated as a result of adding slashes to slashes.

[Sxooter]

yeah, if you double escape, you get things like :

this\'

which means the first / escapes the second /, which means there's nothing to escape the ', which the database sees as a closing field character for the text field.