[RESOLVED] urlencode problem

ade1982

Hey all,

I have this

test.php?id=Couldn%27t+Help+Me

which is obviously achieved by urlencode($blah) in my code, yet the query that is based on the code doesn't work. If I take the apostrophe out of the string, the query works.

Any ideas?

ClarkF1

we need to see more code, but you need to use urldecode and then if you are querying a mysql database mysql_real_escape_string

ade1982

the relevant bits of code are

album.php

while($info2 = mysql_fetch_array( $sql ))
{
echo "<li><span class=\"black\">";
echo "<a href=\"test.php?id=".urlencode($info2[songname])."\">".$info2['songname']."</a> ";
echo "</span></li>";
}

?>

and then

test.php

$sql2 = mysql_query("SELECT * FROM song where songname='$id'");

while($info3 = mysql_fetch_array( $sql2 )) {
	echo "<div class=\"boxcontent\">";
	echo "<h1>".$info3[songname]."</h1>";
	echo "<br/>";
        echo nl2br($info3[lyrics]);
}
?>

I am a complete novice, and heavily struggling, so thanks for replying!

One of the songname records is "Couldn't Hurt Me", and I am having a problem with the ' in that. No problems with brackets or anything.

Weedpacket

So ClarkF1 is right, then.

You might also want to look at Question One in the Newbies' FAQ. Having register_globals turned on is Very Bad.

ade1982

I think it might be because I am stupid, rather than it being a Sunday, but looking at the php manual, I can't work out how to use either of urldecode or mysql_real_escape_string, in the context of the above. :-\

ade1982

can anyone spell it out for me, as I am banging my head now!

ClarkF1

You need to use mysql_real_escape_string on $id e.g. $id = mysql_real_escape_string($id); before querying the database

ade1982

Thank you, it's working nicely (although I haven't used urldecode anywhere!)