Dealing with the ' character in php /Mysql

Anon

I am developing a site which uses php3 and mysql to allow the user to update
their site.

I am having trouble with the ' character in varchar and text column types. I know WHAT the problem is- I just need to know HOW to get it so the user doesn't have to 'escape' the character. I've looked at the documentation, and asked various people but none of their suggestions seem to work...

The workaround I am having to use is that the form which the user fills in has a note on it which
states:

Note: Database uses the ' character as a 'special character' When using ' character, either use \ before it or use two ' characters... e.g:
Jep's is wrong
Jep''s is right

Jep\'s is right

hardly very satisfactory!

The relevant bits of code are- In the form:

The sql query:
mysql_query ("insert into events (event_venue, ) Values '$event_venue', )");

Help Please!

Steve

Anon

Steve Sykes wrote:

The relevant bits of code are- In the form:

The sql query:
mysql_query (\"insert into events (event_venue, ) Values \'$ev....

Try this:

$event_venue=implode(\"'\",(explode(\"\'\",$event_venue)));

before the db insert.

I think there are a few php functions that will do the trick as well, possibly htmlentities() or htmlspecialchars(). I havent tried those, since the above code works for me.

Anon

Since the above code looks nothing like what I actually posted, I've emailed the code to Steve.

Must have been that apostrophy causing problems 🙂

Anon

you can addslashes on the way in, then remove them on the way out with addslashes() and stripslashes()

$sql="insert into events (event_venue, ) Values '$event_venue', )";

mysql_query(addslashes($sql));

when showing to user later...

some SQL...
$event_venue=$obj->event_venue;
$event_venue=stripslashes($event_venue);
print "<P>VENUE:$event_venue;

hope this helps...
-Jeff

Anon

Please..
Can you give some scripts to me??
Is that I'm a student here in Brazil and I need this...
thank you very much..

Steve Sykes wrote:

I am developing a site which uses php3 and mysql to allow the user to update
their site.

The workaround I am having to use is that the form which the user fills in has a note on it which
states:

Note: Database uses the ' character as a 'special character' When using ' character, either use \ before it or use two ' characters... e.g:
Jep's is wrong
Jep''s is right

Jep\'s is right

hardly very satisfactory!

The relevant bits of code are- In the form:

The sql query:
mysql_query ("insert into events (event_venue, ) Values '$ev....

Anon

I started with PHP a couple of weeks ago and hit this problem straight away:
I've got around it by using both addslashes() then htmlspecialchars() - those two should do the trick.

Anon

Thanks to everyone that replied- Problem solved( till next time!!!)