[RESOLVED] How to post proffesionally an HTML data

[mehrzadsoft]

Hi Dears

i developed a personal blog system.
i use an HTML editor. its content must save on MySql data base.
i send it like this:

$body=trim($_POST['text']);

...

$query = "INSERT into $tblname values ('0', '$title', '$body', '$author', '$idcat', '$time')" or die(mysql_error());

...

is it a professional way and is it OK?

thanks.

[Weedpacket]

No, it's not okay. It's very bad.

[mehrzadsoft]

i'm going to read this page
thanks

but what you recomend more?

any especial PHP code?

[BCShaped]

allways use the addslashes() function when inserting data in to a database.

$body=addslashes($_POST['text']);

that way it will escape any ' & " making certain characher look like \" use the stripslashes($post) function to strip the slashes away when reading it yourself.

[madwormer2]

Start at mysql_real_escape_string()
for the basics, but also look at the page that weedpacket gave you.

[mehrzadsoft]

thanks a billion folks!

i lookforward more comments...