Issue with File uploading

Mark_Nordstrom

$form_data1=$_FILES['form_data1']['tmp_name']; 
$date=$_POST['date'];

  $fcontents = file ("$form_data1"); 


  for($i=0; $i<sizeof($fcontents); $i++) { 
      $line = trim($fcontents[$i]); 
      $arr = explode("\t", $line); 
$name=$arr[0]; 
$item=$arr[1]; 
$points=$arr[2]; 
      $sql = "insert into Points_Spent values ('$name','$item','$points','$date')"; 
      mysql_query($sql);
      echo $sql ."<br>\n";
      if(mysql_error()) {
         echo mysql_error() ."<br>\n";
      } 
}

Issue is in the $item some of the content may have a , ' " or other characters in them. How do i make it so the file will upload with these characters in the name of the item ?

Mark_Nordstrom

any ideas guys ? ive been playing with it but cant get it to happen.

netmastan

$item="Mike's bike"

so, this gives error?

try this

$item=addslashes($item);

suntra

netmastan wrote:
$item="Mike's bike"

so, this gives error?

try this
$item=addslashes($item);

Wrong.

Use the mysql_real_escape_string() function. It is more secure than addslashes().

Always always always use that function with strings that come from a user entry, cause you never know what a user can do ! The function helps prevent what we call MySQL injection.

phprock

Thanks for the suggestion.

Mark_Nordstrom

thanks guys