Problems when $title contains a '

MichaelHe

Hi everyone

I have a problem with the 's in some titles.

I have a discography site where all the songs have an ID number, a title and a version in a table.

I then have a list with all the songs in the different versions that links to a DiscographySong.php site with the ID number transfered in the link.

On this site I collect the info about the song like this:

$getsong=mysql_query("select * from DiscographySONG WHERE IDsong='$idsong' LIMIT 1");
while ($row = mysql_fetch_array($getsong)){
$title=$row['Title'];
$version=$row['Version'];
;}

This works fine, and I can use the info just fine.

But now the problem arrives.
I want it to find all the different versions of the song, so I get it to look for all the songs that has the same title like this :

$getsongs=mysql_query("select * from DiscographySONG WHERE `Title`= '$title' ");
while ($row = mysql_fetch_array($getsongs)){

This works just fine untill I click a song there has a ' in the title like all songs with Don't or Won't in the title.
Then it writes

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /usr/home/web/web60269/DiscographySong.php on line 98

So for some reason when $title contains a ' it doesn't work.

What am I doing wrong ??

best
Michael

bpat1434

Try using [man]addslashes/man to escape them.

$title = addslashes($title);
$getsongs=mysql_query("select * from DiscographySONG WHERE `Title`= '$title' ");

And of course, another option:

$title = str_replace("'", "\'", $title);

~Brett

rincewind456

mysql_real_escape_string()

MichaelHe

$title = addslashes($title);

Worked :o))

What does it do ?
If there was a song called Don't and a song called Dont would it then find both of them ?

TobyRT

It should do - all the addslashes command does is tell the php to ignore the ' marks (which are also part of php/sql syntax) when it finds them within a variable (eg $title).

Of course, some data validation might be nice to make sure you're not mis-spelling 'dont' - since that word doesn't exist in the english language!!

rincewind456

MichaelHe wrote:
$title = addslashes($title);

What does it do ?

It does what it says on the box

Returns a string with backslashes before characters that need to be quoted in database queries etc. These characters are single quote ('), double quote ("), backslash () and NUL (the NULL byte).

If there was a song called Don't and a song called Dont would it then find both of them ?

would you expect it to find floor and flood?

It doen't tell php to do anything it tells a sql database that the escaped quote is not part of the sql syntax.

MichaelHe

rincewind456 wrote:
It does what it says on the box

would you expect it to find floor and flood?

No but floor and flood have different letters.
As I see it, it will remove the ' and then Don't and Dont is the same. ?

rincewind456

MichaelHe wrote:
No but floor and flood have different letters.
As I see it, it will remove the ' and then Don't and Dont is the same. ?

Think characters not letters!
Floor and Flood have different characters.
Don't and Dont have different characters.

MichaelHe

Yes I understand, but if it ignores the ' in " don't " won't it be the same as " dont ".

If there is a song called "Don't You Worry" and I write $title = addslashes($title);
Won't it find a song called "Dont You Worry" too.
I know the word do not exist, but it's only an example.

bpat1434

No no no... it doesn't ignore it. It escapes it, so that ' is interpreted as a literal character, NOT as a string terminater.

So $title = addslashes($title); will print out:
Don\'t You Worry Too

So the query will be:
SELECT * FROM table WHERE title='Don\'t You Worry Too'

The backslash escapes a character so it's interpreted as a literal character. So Don't You Worry Too will be different that Dont You Worry Too.

One way to circumvent it is to replace the ' with it's HTML entity in the database.

Understand now?

~Brett

MichaelHe

OK.. now I see. 😃

I thought it ignored the '

OK, now all my worries are over.
Thanks for your support 🙂