[RESOLVED] removing ' character from a string

irishgirl2004

Hi,
I have a string that containts the ' character. I want to add this to a database, but i get an error, here is my code

$queryins = "INSERT INTO bbpackages VALUES ('','$myrow1[1]','$myrow3[2]','$table')";
$insresult = mysql_query($queryins);

its the $table variable that contains the offending character.

thanks

bradgrafelman

Where is this variable coming from? Where are all of the variables coming from?

If it's user-supplied data, you should always run it through [man]mysql_real_escape_string/man first. Sounds like you need to use this function in this case whether it's user-supplied or not, though.

irishgirl2004

its being inputted by a user... the others are existing values in a database

alimadzi

irishgirl2004 wrote:
its being inputted by a user... the others are existing values in a database

Yeah, in that case Brad is absolutely right. Always... ALWAYS... escape data from users before using it in a query. Any other questions?

irishgirl2004

alimadzi wrote:
Yeah, in that case Brad is absolutely right. Always... ALWAYS... escape data from users before using it in a query. Any other questions?

thats my question, how do i do this?

alimadzi

irishgirl2004 wrote:
thats my question, how do i do this?

Like this...

$table = mysql_real_escape_string($table);
$queryins = "INSERT INTO bbpackages VALUES ('','$myrow1[1]','$myrow3[2]','$table')";
$insresult = mysql_query($queryins);

irishgirl2004

cool, thanks