Help with inserting and including '

jbachris

I have this code for my insert:

$sql = "INSERT INTO hpt(date, headline, story) VALUES('$date', '$headline', '$story')";

When I try to insert a news story and use an apostrophe, ' , I get this error:

Error in query: INSERT INTO hpt(date, headline, story) VALUES('20061012 ', 'Test', 'TEastas'asfd'). You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'asfd')' at line 1

How can I fix this?

Piranha

For security reasons you should wash everything that you insert in your database with mysql_real_escape_string before inserting it in the database.

jbachris

so use:

VALUES('".mysql_real_escape_string($_POST['news_date'])."')

Piranha

Exactly. You can use sprintf to make it easier to see what you are doing, like this.

 $sql = sprintf("INSERT INTO hpt(date, headline, story) VALUES('%s', '%s', '%s')",
   mysql_real_escape_string($date),
   mysql_real_escape_string($headline),
   mysql_real_escape_string($story)
);

jbachris

I tried this, still doesn't allow the news_story field to include a '

$sql = sprintf("UPDATE news SET news_date = '" . $_POST['news_date'] . "', news_headline = '" . $_POST['news_headline'] . "', news_story = '" . $_POST['news_story'] . "' WHERE ID = '" . $_POST['ID'] . "'",
	   mysql_real_escape_string($news_date),
	   mysql_real_escape_string($news_headline),
	   mysql_real_escape_string($news_story)
	);

ClarkF1

 $sql = sprintf("UPDATE news SET news_date = '%s', news_headline = '%s', news_story = '%s' WHERE ID = '%s' ",
       mysql_real_escape_string($_POST['news_date']),
       mysql_real_escape_string($_POST['news_headline']),
       mysql_real_escape_string($POST['news_story']),
mysql_real_escape_string($_POST['ID'])
    );

jbachris

ok, what do i use the '%s' or replace it with something?

Weedpacket

Read the manual page for [man]sprintf[/man] and find out for yourself.

jbachris

or you could help people instead of getting on a power trip, whatever floats your boat though...

Piranha

Maybe you could try to RFTM and STFW a little instead of asking questions that is very easy to get answers to. Then you don't have to bother others with every little detail, it is ok to ask a question but it is not ok to expect strangers to solve your problems.