[RESOLVED] PHP, MySQL and quotes

[nogeekyet]

I have a problem getting results when I encounter a quote in a name such as O'Neil.
If I use:
$query = "SELECT *
FROM students
WHERE LastName= '$Name'
";

This does not work (db error) when I encounter an O'Neil.

Using:
$query = 'SELECT *
FROM students
WHERE LastName= "$Name"
';

the query does not have an error but the number of rows retrieved is zero.

Any ideas why I don't get any rows?

[nemonoman]

[man]addslashes[/man]

[nogeekyet]

Thank you my man. All the "O'Neil" students of California will thank you as well:p

[laserlight]

Eh, do not use addslashes() to escape data to be used in an SQL statement. Use prepared statements, or if that is not feasible, then use the appropriate escaping mechanism, e.g., [man]mysql_real_escape_string/man for strings with the MySQL extension.