I am trying to use the addslashes() function and it is not working. I have a field that allows user input so they may use ' so I am trying to use addslashes and I get the following error:

Warning: mssql_query() [function.mssql-query]: message: Line 1: Incorrect syntax near 't'. (severity 15) in c:\inetpub\wwwroot\niffer\NewTicket.php on line 129

Warning: mssql_query() [function.mssql-query]: message: Unclosed quotation mark before the character string ' )'. (severity 15) in c:\inetpub\wwwroot\niffer\NewTicket.php on line 129

My code is:

$subject = addslashes($subject);
$comment = addslashes($comment);
$query = "INSERT INTO tblIssues
(IssueNumber,firstname,lastname,phone,email,issuetype,subject,comment,submittime,status)
VALUES('$MaxNumber','$firstname','$lastname','$phone','$email','$type','$subject','$comment','$time','$status' )";
$result = mssql_query($query) or die ("Query failed");

I get these errors when I use the work "can't" in the user field.

Can someone please give me suggestions.

Thanks,

    Try echoing it out before you addslashes and after you addslashes. See what changes.

      Before I use addslashes(), the print out is:

      This didn't work

      After, the print out is:

      This didn\'t work

        MySQL is interpreting the single quote in can't as a terminating quote for the value in which you are enclosing it. (even if you escape it.) Do this:

        $query = "INSERT INTO tblIssues
          (IssueNumber, firstname, lastname, phone, email, issuetype, subject, comment, submittime, status)
         VALUES('$MaxNumber', '$firstname', '$lastname', '$phone', '$email', '$type', '$subject', \"$comment\", '$time', '$status')";

        notice the escaped double quotes around the COMMENT value. if that's the field that allows single quotes, then it needs to be surrounded by escaped double quotes. Of course, you'll have to disallow double-quotes:

        str_replace('"', "'", $comment)

          Also, dpending on which version of MySQL you are running, you could also try to double the single quote. Apparently you can include two single quotes to mean one single quote. Try replacing ' (a single quote) with '' (two single quotes) and see if that is effective in writing 1 single quote.

          Also, I didn't think about this in my last post, but it may be that PHP is interpreting the escaped characters first and MySQL doesn't recieve the escape character. (I'm not really sure about this.) But anyway, you could replace ' with \' and see if the escape character gets into the MySQL query.

            I just read an article that said that I am not able to use the addslashes() function with MSSQL. So I used $subjectdq = str_replace("'", "''", $subject); instead and it worked!

            Thanks for your help.

              I didn't catch that you were using MSSQL, I thought it was MySQL... regardless, I'm glad it worked.

                Write a Reply...