[RESOLVED] INSERT with data that has Quotes and Apostrophe

[luiddog]

I'm trying to make an INSERT statement with data that has both quotes (") and apostrophes ('). So my data looks like this

---

Data 1:
Address: 123 Elm
City: Riverdale
State: MD
County: PRINCE GEORGE'S
Comment: This is a "Good" place

Data 2:
Address: 123 Elm
City: Stevensville
State: MD
County: QUEEN ANNE'S

Comment: This is another "Good" place

I tried building this statement:

do {
$Address = $row_place['Address'];
$City = $row_place['City'];
$State = $row_place['State'];
$County = $row_place['County'];
$Comment = str_replace('"','',$row_place['Comment'];) ///Remove quotes from Comment

$query = 'INSERT INTO places (`id`, `address`,`city`, `state`, `county`, comment`) VALUES (NULL, "$Address", "$City", "$State", "$County", "$Comment")'
} while($row_place = mysql_fetch_assoc($place)

But what happens is that $Address, $City, etc.. gets inserted. Not the data.

[laserlight]

You are using the MySQL extension, so use [man]mysql_real_escape_string/man. No need for str_replace().

[luiddog]

So how would it work if only the Address, County and Comment need fixing? Something like this:

$query = sprintf("INSERT INTO places (`id`, `address`,`city`, `state`, `county`, comment`) VALUES (NULL, '%s', '$City', '$State', '%s', '%s')",
            mysql_real_escape_string($Address),
            mysql_real_escape_string($County),
            mysql_real_escape_string($Comment))

[luiddog]

Works great. Thanks.