[RESOLVED] prob with '+' preventing insert

VisionsOfCody

I've been having problems with inserts not happening and I've narrowed it down to the fact that one of the strings contains a '+' character and this is what seems to block the insert - the db field type is MEDIUMTEXT, so :

do i need to do something to the string or something to the field ?
are there any other characters that may cause probs in a similar way ?

thanks

Roger_Ramjet

I doubt very much that it is the + sign that is causing your insert to fail. If the string is properly enclosed in quotes then it really does not matter what the contents are. Echo out the query that is failing and post it here so we can see what is going on.

stolzyboy

are you using GET as your method for the form?? only thing i can think is the url is getting encoded and then trying to be inserted into the db

if not, do yo know where the + is coming from or why it's there? do you need it?

VisionsOfCody

Hi - thanks for your replies

I'm not using a form - the query is built from data contained in a big session variable

here's the query as it echoes

INSERT INTO commandes (comm_id , client_id , comm_date , comm_livre , comm_total , comm_pan , comm_corb , pan_prix , pan_content , corb_prix , ami_comm , comm_jour , comm_jour_num ) VALUES ( '' , '6' , '2007-01-03' , '0' , '25' , '1' , '' , '20' , '2 belles salades|Pommes de terre (env 1 kg)|Tomates pour la salade (env 1 kg)|légumes d'antan - panais,topinambour,(env. 800 g) et recettes|Clémentines de Corse (env 1kg) Extra!!!|Bananes (4 pièces env 500grs)|Pommes à croquer (env 1 kg)|Bouquet de persil (offert)!!!|' , '15.00' , '' , '2007-01-09' , '4');

btw - you were right about the '+' not being the problem - the minute I previewed this post I noticed that I hadn't escaped the ' in "d'antan" !!!!

what a klutz

thanks anyways

Roger_Ramjet

So now you know one of the reasons why you should be using mysql real escape string on all string data you insert into your db. Have a read of the manual and you'll find out that the other reason is even more important.

VisionsOfCody

Roger Ramjet wrote:
So now you know one of the reasons why you should be using mysql real escape string on all string data you insert into your db. Have a read of the manual and you'll find out that the other reason is even more important.

yikes :eek:

Dammit - that means I'm going to have to go through my sites and put it in all over the place - not sure if I should thank you or curse you, hehe

but thanks for that - I may have been victim to an sql injection recently and this may have prevented it