[Resolved] why is this query ignoring my escapes?

returnButton

hi, i have the following code:

update reviews set title='here\\'s an apostrophe' where reviewID=4

i am also echoing it to screen + it looks like it's escaped properly to me, but i still get this:

Warning: SQL error: [Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression ''here\'s an apostrophe'.......SQL state 37000 in SQLExecDirect.......

i am using Access with PHP 4.3.1 and the following:

magic_quotes_gpc On On
magic_quotes_runtime Off Off
magic_quotes_sybase Off Off

any help appreciated - if i do the exact same query without the quote it works!!

ta..

Lars_Berg

use ' for escape in SQL.

Sxooter

Plus, he's trying to insert binary data by just escaping a few characters.

Generally, it's a better idea to use some kind of encoding, like base64 et. al. to prepare binary data to be stored in a database.

returnButton

big thanks..

so do you encode every piece of data you store and decode it when you read it? even non-sensitive data and long-text fields? safe idea i suppose, but doesn't it slow down processing?

Sxooter

Not encrypt, encode. And only binary data.

I.e. if it's text, you just escape it and you're golden. If it's a jpeg, mpeg, mp3, executable, etc... then you should base-64 or otherwise encode it before storing it. Or, if your database has some kind of binary large object support, you could use that, but I'm no big fan of large objects.

Sxooter

Ooops, sorry, I got another thread mixed up in this one. Never mind my posts on this one...