Getting rid of apostraphes

[mrgrammar]

$putitemin = "INSERT INTO catitem (catitemid,catitemname,catitemdesc,catitemimg,catitemimg_tn,catitemactive,catcategoryid) VALUES ('".$itemid."','".$itemname."','".$desc."','".$fullimage."','".$fullthumb."','".$itemstatus."',".$category.")";

mysql_db_query($database, $putitemin);

---

I have three questions.

1. Does a varibable have to all be defined on one line? For example, could I also define $putitemin to be more readable:

$putitemin = "INSERT INTO catitem (
catitemid,
catitemname,
catitemdesc,
catitemimg,
catitemimg_tn,
catitemactive,
catcategoryid)
VALUES (
'".$itemid."',
'".$itemname."',
'".$desc."',
'".$fullimage."',
'".$fullthumb."',
'".$itemstatus."',
".$category.")";

2. When inputing data, if there is an apostraphe in the data, the insert does not work. For example, if I enter

"It's a wonderful life" for $desc, the insert does not occur.

How do I remedy this problem?

3. Currently, I have no way of knowing if an insert fails. Is there a way that I can be notified if the insert fails?

[mrgrammar]

Nevermind about question 3. I forgot to put in the 'or die()' on the query execution.

[dalecosp]

1. Generally, you can make it more readable as per your example.

2. Data like this should be escaped; PHP has a function, [man]addslashes[/man] that is made just for this purpose. An alternative might be 'magic_quotes_gpc" ON in php.ini......

3. Do you mean remote notification, like if someone else is running the script and it fails, or just notifying you as the script user??

Try this:

$success=mysql_db_query($database, $putitemin);
if (!$success) {
    echo "Oops!  Couldn't perform db query!!";
}

[mrgrammar]

Actually, all I needed was the 'or die' message. This is just for me with admin section. When I begin working with the public side, I'll be using a method similar to what you suggested.

Thank you very much. BTW, addslashes() worked (as I'm sure you knew it would).

[dalecosp]

You're quite welcome, of course. 🙂