[RESOLVED] INSERT a variable that has ' in it

[Oni]

Hi--

I'm having some difficulty in placing a variable inside a mysql table that has a ' in it.
Ex:

mysql_query("INSERT INTO arama (id, klasor, boyut) VALUES('$id', '$db[0]', '$db[1]')")
or die(mysql_error());

The code works until the value of $db[1] has a ' in it.

What can I do to fix it?

Thanks!

[rincewind456]

[man]mysql_real_escape_string/man

[laserlight]

Use [man]mysql_real_escape_string/man. Better yet, use prepared statements with the MySQLi or [man]PDO[/man] extension.

[Oni]

Thanks for the answers, however now I don't see any updating to the table when I run the code. I also don't see any error.

$query = sprintf("INSERT INTO arama (id, klasor, boyut) VALUES('$id', '$db[0]', '$db[1]'",
 mysql_real_escape_string($db[0]),
 mysql_real_escape_string($db[1]));
mysql_query($query); 
print ".";

Is what I have.

I know that the above statement is run because I see periods when the script is finished.

[laserlight]

You did not write your sprintf() correctly:

$query = sprintf(
    "INSERT INTO arama (id, klasor, boyut) VALUES(%d, '%s', '%s')",
    $id,
    mysql_real_escape_string($db[0]),
    mysql_real_escape_string($db[1]));
mysql_query($query);

[Oni]

I see, thanks 🙂