[RESOLVED] Queries with data that includes ' symbol

sparksy83

I am having trouble inserting a list of towns into a database. The code reads from an Excel file and inserts the town name and a value that is looked up from another table.

The code for the insert statment is:

$insertPostcode[$i] = mysql_query("INSERT INTO probid_towns
(town, region_code) VALUES ('".$town."','".$exists['region_code']."')");

If the town name includes a ' symbol such as "Devil's Bridge" then the code brings up an error due to the extra '. Is there anyway to work round this or do I just have to remove the ' from my Excel file?

laserlight

Use [man]mysql_real_escaped_string/man
Use prepared statements with [man]mysqli[/man] or PDO.

frost110

Or addslashes() works great. Just remember to strpslashes when retrieving the data.

--FrosT

Drakla

Frost, you've just said the most wrong thing I've heard, you don't stripslash data when you pull it from the database. You don't use addslashes when you've got the proper function for your database to do the job for you.

Here's a starting point
http://www.webmasterstop.com/63.html

He doesn't mention mysql_real_escape_string, but that's what to use when you're using mysql.

frost110

Thanks for correcting me Drakla. I never really learned anything about it. All I knew about that was what I learned from reading code. Never took a PHP class, all self taught =) Definatley going to read up on it. Thanks again!

--FrosT