mysql instert with function / escape chars problem

[sid]

following problem:

function store_some_crap($subj = "", $body = "") {
	if ($body) {
		if (@mysql_query("INSERT INTO msg
			(subj, body)
			VALUES ('" . $subj . "', '" . $body . "');") or
		die ("<B>Error</B>")) {
			return TRUE;
		}
		else {
			return FALSE;
		}
	}
	else {
		return FALSE;
	}
}

when i try inserting data (fromuser form) in the database by calling the function above i run into the problem that the input of a ' will cause a mySql error.

using this query:

//...
		INSERT INTO msg
			(subj, body)
			VALUES (\"" . $subj . "\", \"" . $body . "\");
//...

(the parser swallowed the first escaped ")

resolves this problem BUT causes the same behavior with " s.

none of these problems exist when i insert the values straight from the input fields without passing it on to the function. i figured thats an encoding problem and wondered if anyone out there knows how to resolve this crap. ive run into this before, yet this time i really cannot work around it.

what i am doing right now is

//...
		INSERT INTO msg
			(subj, body)
			VALUES ('" . str_replace("'", "`", $subj) . "', '" . str_replace("'", "`", $body) . "');
//...

but this is just a really crappy solution... so...

as usual - happy about any suggestions i hope y'all have a bit of vacation time..
rock on - sid

[pete_bisby]

Use the addslashes() function, which will add a slash before any single and double quote in your string:

INSERT INTO msg (subj, body) VALUES ('" . addslashes($subj) . "', '" . addslashes($body) . "');")

Just remember to use the stripslashes() function to remove the slashes when you're displaying the data.

[cruz610]

//... 
        INSERT INTO msg 
            (subj, body) 
            VALUES ('" . $subj . "', '" . $body . "'); 
//...

note the use of ' instead of " for the beginning quotes...

[sid]

thanks guys...

of course i should have mentioned the addslashes() possibility as well - the thing i wonder about mostly - i guess - is what happens to the data when it get passed into the function, and why does this cause problems with mysql, if the exact same data works just fine when you shortcut and dont use the function...

@: sorry, but i dont really see anything different in what you suggested to what i was trying already. thanks anyway.

rock on!