Problems with INSERT

Abarak2002

Hello fellow PHP enthusiasts

At the moment I am currently experiencing problems adding information to a table cell due to the fact the value contains ‘. Bellow is what my current INSERT script looks like:

$conn = odbc_connect(MME_DB, MME, ******);

$DisplayName = $_POST['DisplayName'];
$Mini_pic = $_POST['Mini_pic'];
$Big_pic = $_POST['Big_pic'];
$Brief_desc = $_POST['Brief_desc'];

$query = "INSERT INTO Products (Display_name, Mini_pic, Big_pic, Brief_desc) VALUES ('$DisplayName', '$Mini_pic', '$Big_pic', '$Brief_desc')";

$cur = odbc_exec($conn, $query);

As you can see the VALUES ('$DisplayName' contains the ‘s which means disaster for me since the $DisplayName value also contains ‘. If anyone can provide me with any assistance it would be most helpful.

Have a great day!

Abarak2002

cgraz

if you have apostrophes in the string, use addslashes()

Cgraz

ucbones

in fact, even if you don't have apostrophes, but there is a remote possibility that you might, addslashes().

This is especially true whenever passing information gained from site users to a database.

Always, always addslashes.

On one of my current sites, I omitted this detail, so user input that contained the phrase

' DROP DATABASE db_name;

would remove my database. oops

Don't let them do this to you- addslashes()

ucbones

Abarak2002

Hmmm.... I may be using addslashes(); wrong but this is what happens....

INSERT Output = INSERT INTO Products (Display_name, Mini_pic, Big_pic, Brief_desc, Brief_2nd_desc, Price, Listed_price, Quanity, Specifications, Warranty, Added_info, Show) VALUES ('Test', '', '', '', '', '0', '', '', 'Test\\'s', '', '', '1')

Error = Warning: SQL error: [Microsoft][ODBC SQL Server Driver][SQL Server]Line 3: Incorrect syntax near 's'., SQL state 37000 in SQLExecDirect in C:\Documents and Settings\Chad\Desktop[url]www.M&MElectronics.com\Admin\Products\Products\Add.php[/url] on line 30

When using addslashes(); like this....

$Specifications = $_POST['Specifications'];
$Specifications = addslashes($Specifications);

While the input field for Specifications = Our's

Any Idea?

Abarak2002

mattr

That is what happens when you do not specify which DBMS you are using.

MS SQL escapes single quotes by double quoting them.

You need to replace all ' with ''. This is accomplished using str_replace.

Abarak2002

Originally posted by mattr
MS SQL escapes single quotes by double quoting them.

You need to replace all ' with ''. This is accomplished using str_replace.

Correct me if im wrong but wont this change the value of Specifications from (Our's) to (Our"s)? If so, then is there any other way to resolve this particular problem since the value for Specifications will more the likely contain ' and ".

Also, thank you for all your help in this particular matter.

Abarak2002

mattr

MS SQL will invisibly change all double single quotes to a single, single quote.

Trust me, it will be fine. Give it a try. 🙂

Abarak2002

Hey! It works just as expected!

The str_replace("'", "''", $var); works like a charm.

Thanks for your help, it is most appreciated!

By the way, why would I want to use addslashes()? It seems as if MS SQL adds them already.....

Any ways, thanks again!

Abarak2002

mattr

You don't want to use addslashes.