single quote & addslashes() issue

jeepin81

The Irish are messing up my data input!

So, I have this simple code, it reads an employee contact table and put's into a different table for a schedule and this new employee O'Malley is giving me this error:

Insert Error - Line 45: Token MALLEY was not valid. Valid tokens: ) ,. SQLCODE=-104

Here's my code that is giving me issues:

$name = addslashes(rtrim($row['SNAME']));
$type = addslashes(rtrim($row['STYPE']));
$sempno addslashes(rtrim($row['SEMPNO']));

	$insert = "INSERT INTO internet.day_sched(EID, NAME, DEPT, SCHED, FAX, LUNCH, TAG, IN, OUT)
			VALUES('$sempno', '$name', '$type', 'x', 'x', 'x', 'Y', 'x' ,'x')";

	$execINSERT = db2_exec($i5db2, $insert)
					or die("Insert Error - Line 45: " . db2_stmt_errormsg());

I'm adddingslashes and if I echo it out I can see slashes are being added but it's still bombing out on me? Not sure what I'm missing and I don't want to remove the single quote, as it is part of their name.

Any insight would be appreciated!

Thanks,
j

dagon

you should be using db2_escape_string not addslashes

NogDog

Also make sure that magic_quotes_gpc is turned off, or else that you undo its damage.

jeepin81

Thanks Guys - db2_escape_string() worked. Don't know how I forgot about that.

Is there a reason that addslashes() is not working? I've used it w/ other data input and it worked fine. The only difference I can think of was this particular data was enter via a 400 green screen shell and my previous data was entered via the web.

Thanks again.

NogDog

addslashes() may not escape every character that needs to be escaped for any particular DBMS, and may escape characters that do not need escaping. Thus it's always best to use the escape mechanism designed for the DBMS being used. (Or use a DB abstraction layer with prepared statements, so that the specifics for a given DBMS are down at a layer you don't really need to pay attention to any more.)

johanafm

Addslashes may also escape characters incorrectly. For example, the single quote character in a character string is escaped by a single quote according to standard SQL: O'Malley => O''Malley
Still, some DBMS escapes single quotes by prepending something else though: O'Malley => O\'Malley
This means that addslashes may or may not work (although I believe DB2 actually does use \'), while a DBMS specific escape function will know what to do.

It is also entirely possible that an ini setting or run time specification changes how your DBMS interprets certain characters. For this reason, making use of a DBMS specific escape function requires you to have a connection to the database so that the function will know what to escape and how to do it.