[RESOLVED] special characters

lglben

When I try to send the contents of a textarea from a form to my database I get errors if the textarea contained certain characters - for example, ' or ". The errors appear in my SQL syntax only when those characters are entered, so I need to escape them somehow. How should I format the variable containing the text so that this error doesn't occur?

By the way, I am already using htmlspecialchars() on the variable in question. Am I going to have to use regular expressions ::gulp:: ?

laserlight

Single quotes need to be escaped in the SQL, usually by doubling them. MySQL allows for backslashes to escape single quotes.

lglben

Thanks - you were pretty quick!

Actually, I did a search on escape quotes and found out that I need to use addslashes() and stripslashes() before/after submitting/extracting from the database. Unless, that is, I'm still missing something here...

msk_1980

You can escape special charecters in the post variables using the addslashes(). you need to check before for the configuration of the magic_quotes_gpc. here is the reference of the manual that explains the process of doing it.

http://au3.php.net/manual/en/function.get-magic-quotes-gpc.php

msk_1980

you need to check before for the configuration of the magic_quotes_gpc. here is the reference of the manual that explains the process of doing it.

http://au3.php.net/manual/en/function.get-magic-quotes-gpc.php

laserlight

Actually, I did a search on escape quotes and found out that I need to use addslashes() and stripslashes() before/after submitting/extracting from the database.

It depends on your database, and probably only works with MySQL. Doubling single quotes is standard.

lglben

I see, thank you. Sorry for the slow reply - been away from the comp for a day or so.

Actually, I'm using MySQL and PHP - it's just a hobby project so cross-compatibility with other databases is not really important.

By the way, I enjoyed the link in your sig about asking questions on technical forums... so thanks for that, too.

rincewind456

You should be using mysql_real_escape_string()

lglben

On the same page that you just linked to, I find:

If anyone is using addslashes to escape strings before putting them in the database and thinks they should "upgrade" to mysql_real_escape_string because it is safer (as the instructions above seem to imply): if you read mysql's manual for the function that is being called by php, it says
--QUOTE
Strictly speaking, MySQL requires only that backslash and the quote character used to quote the string in the query be escaped. This function quotes the other characters to make them easier to read in log files.
ENDQOUTE--
So if you're using addslashes, which escapes single and double quote and backslashes, you're OK.

rincewind456

lglben wrote:
On the same page that you just linked to, I find:

It's up to you whether you do as a single user contributed note says or the Official manual.

The manual says

mysql_real_escape_string() calls MySQL's library function mysql_real_escape_string, which prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a.

This function must always (with few exceptions) be used to make data safe before sending a query to MySQL.

Personally I'll go with the manual. 😃

lglben

OK, good point. Thanks.