Syntax error with the symbol '

steveDD

Hi I keep getting this syntax error. Basically I have a form in my admin which I add details to and click update and it updates my MySQL DB. However when I am using words such as steve's and we're it doesn't like the ' I use and kicks it back. I didn't have problems with this before but it has just started doing it a lot. Any help. (I have included the error message),

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's the UK network of T-Mobile International, a major branch of Deutsche Telekom A' at line 1

igorlopez

In general if you need to include ' or " into a field you need to either use a different outside delimiter, "Steve's" and 'My little"c' will both work. If you have no control over the delimiters used for the string you need to find out which are used and then adapt like:
' are used as delimiters: 'Steve''s' and 'My little"c' will produce the same as when
" are used: "Steve's" and "My little""c" are the same in both cases.

I hope i make myself clear.

steveDD

Sorry no, not because you don't make sense but because I have no clue. Basically the text I input needs to be viewed on my website so wouldn't using "" etc just display them to?

Also it worked fine when I inputted these ' symbols the other day its since I moved the admin to a SSL folder the problems have started.

Steve

Kudose

You need to escape your data before inserting it.

See [man]mysql_real_escape_string[/man]

NogDog

It may be that your original host configuration had the (deprecated) magic_quotes_gpc "feature" enabled, while the current host config has it (correctly) turned off, requiring that you use the applicable escaping mechanism for your DBMS, such as the [man]mysql_real_escape_string[/man] function mentioned above if you are using the basic MySQL extension.

steveDD

Right will this help i tried entering some text and used \ before the ' and it loaded with no problems. does this mean that it is the problem you talk of and how would I implement this string in my code so it will work.

NogDog

Read the mysql_real_escape_string() manual page, and it will explain what it does and provides some useful examples. Also see this "Security Corner" article and this comic to understand why it should be done.

Kudose

Nice comic. 🙂