[RESOLVED] Insert Query + Slashes

[obrienkev]

Hi all,

I'm working on MS SQL Server. How do I get the below to work. How do I remove the slashes??

INSERT INTO training(class_ID, ffnumber, firstname, surname, attended, passed, date_reg) VALUES('6697', 'ff20946', 'Kevin', 'O\\\'Brien', 'No', 'No', {fn NOW()})

[laserlight]

I'll hazard a guess that this will work:

INSERT INTO training(class_ID, ffnumber, firstname, surname, attended, passed, date_reg)
	VALUES('6697', 'ff20946', 'Kevin', 'O''Brien', 'No', 'No', {fn NOW()});

[obrienkev]

Sorry forgot to say I have variables set and the above is an echoed query.

$firstname = $_POST['firstname'];
$surname = $_POST['surname'];
echo $surname;

$surname gives: O\\'Brien

[laserlight]

um, stripslashes()?

[obrienkev]

Thanks.

Using stripslashes gives me this(echoed)...
INSERT INTO training(class_ID, ffnumber, firstname, surname, attended, passed, date_reg) VALUES('6697', 'ff20946', 'Kevin', 'O'Brien', 'No', 'No', {fn NOW()})

How do I add another ' in 'O'Brien to make it 'O''Brien

Thanks.

[laserlight]

How do I add another ' in 'O'Brien to make it 'O''Brien

Use str_replace()? I cant find an appropriate escaping function for mssql.

You may want to use prepared statements with PDO instead.

[obrienkev]

This worked...

// Stripslashes on surname
$surname = stripslashes($surname);
//echo $surname;
$surname = stripslashes($surname);
//echo '<p>'.$surname.'</p>';

// Format surname for DB
function addslashes_mssql($surname){
    if (is_array($surname)) {
       foreach($surname AS $id => $value) {
           $surname[$id] = addslashes_mssql($value);
       }
    } else {
       $surname = str_replace("'", "''", $surname);   

    }

return $surname;
}

// Call Function
$surname = addslashes_mssql($surname);
//echo $surname;