[Resolved] Replace sting characters for SQL insert and updates

[wacook]

I need to alter the string inserted or updated from a form. The users may us ', #, ", or other characters that cause the sql insert or update to error.

How do I change the string so the users can use these characters and still send the data into a varchar field?

I would like to change the ' to '''. Or the " to '"'.

[drew010]

use [man]addslashes[/man] on the string before it gets inserted.

i.e.

$_POST['text'] = addslashes($_POST['text']);

$query = "INSERT INTO table VALUES('{$_POST['text']})";
//no longer gives errors about the characters because they are escaped.

[wacook]

I tried the above with no luck. But I found in the manual the following that fixed my problem.

$str= stripslashes(strtr($str,"\"",""));//this gets ride of the\
$str= str_replace("'", "''", $str);//this puts ' around the single quotes.

Now the sql insert or update commands work fine.

FYI