[RESOLVED] help inserting ampersand in mysql db

sks1024

I am having a hard time getting a string from a text area that contains an ampersand inserted in my table. the string inserts up to the ampersand and stops.

string = "board of e & q"

this is what is inserted in my table "board of e "

i have tried using htmlspecialchars with no luck.

any more suggestions?

thanks

NogDog

I am not aware of any reason that an ampersand should be a problem with MySQL queries. As to what the actual problem is, I do not have a guess based on the currently available data.

sks1024

Don't know what to say. All other symbols (* % $ #) insert just fine.

bradgrafelman

Can you show us some example code that you used to insert and later retrieve the string?

sks1024

function addEvent(day, month, year, body) {
		if(day && month && year && body) {




		// alert('Add Event\nDay: '+day+'\nMonth: '+month+'\nYear: '+year+'\nBody: '+body);
		new Ajax.Request('rpc.php', {method: 'post', postBody: 'action=addEvent&m='+month+'&d='+day+'&y='+year+'&body='+body+'', onSuccess: highlightEvent(day)});
		$('evtBody').value = '';
	} //else {
		//alert('There was an unexpected script error.\nPlease ensure that you have not altered parts of it.');
	//}

	// highlightEvent(day);
} // addEvent.


<textarea id="evtBody" cols="32" rows="5"></textarea>
			<br>
			<input type="button" value="Add Event" onClick="addEvent($F('evtDay'), $F('evtMonth'), $F('evtYear'), $F('evtBody')); ">
			<a href="#" onClick="Element.hide('addEventForm');">Close</a>





$body = htmlspecialchars($_POST['body']);

	$timeStamp = mktime(0,0,0, $month, $day, $year);
	$bodyF = addslashes(trim($body));
	$addEvent = mysql_query("INSERT INTO event (body, timestamp) VALUES ('$body', '$timeStamp')", $conn);

bradgrafelman

Is 'body' being properly escaped by the JS? Try echo'ing out $_POST['body'] in the PHP script (or doing an alert(body) in the JS code) to make sure that PHP is receiving the data correctly.

sks1024

i can manually add the the string to be inputed in the sql statement to "board of b & e" and it inputs fine. So somewhere the & isn't getting escaped.

bradgrafelman

Try changing the +body+ to +escape(body)+ in the JS code.

etully

I suggest using one of the three JS escape commands on this page:
http://xkr.us/articles/javascript/encode-compare/

Just before the new Ajax.request, put something like this:
body = encodeURI(body);

sks1024

that worked liked a charm.

thanks again.

bradgrafelman

Don't forget to mark this thread resolved (if it is).