dealing with apostrophe in submitted text

twoclones

I have started using the Simple Help Desk script from http://simplehelpdesk.com for our internal help desk and it's working very well in this tiny company. However, when anyone uses an apostrophe in their help desk submission form, this error is generated:
mySQL Returned: You have an error in your SQL syntax...etc

How can I make this script handle the apostrophe properly? Perhaps use a regexp in the lines defining the submissions? If so, what would I add to this line?

$ticket_subject = $_POST['ticket_subject'];

bradgrafelman

User-supplied data should never be placed directly into a SQL query! Instead, sanitize it with a function such as [man]mysql_real_escape_string/man.

twoclones

Thanks,

Changing various lines from this [for example]:
$reply_content = $POST['ticket_content'];
to this:
$reply_content = mysql_real_escape_string($POST['ticket_content']);
took care of the apostrophe problem.

HOWEVER...
One of the lines I needed to edit was already using strip_tags so I replaced strip_tags with mysql_real_escape_string. But what if I wanted to keep both functions? How would that be coded?

I changed this
$ticket_subject = strip_tags($POST['ticket_subject']);
to this
$ticket_subject = mysql_real_escape_string($POST['ticket_subject']);

What would it look like to use both functions together?

cgraz

twoclones wrote:
I changed this
$ticket_subject = strip_tags($POST['ticket_subject']);
to this
$ticket_subject = mysql_real_escape_string($POST['ticket_subject']);

What would it look like to use both functions together?

You first create a variable $ticket_subject which holds the result of $_POST['ticket_subject'] after strip_tags() has run on it.

So when you want to run mysql_real_escape_string(), you want to run it on the code after the tags have been stripped out, not on the initial code. $_POST['ticket_subject'] is never changed. So in the second part of your code, you would run mysql_real_escape_string() on $ticket_subject.

$ticket_subject = mysql_real_escape_string( $ticket_subject );