hey need some help with '

[sinista]

hey can some one help me with this please,

 

when ever i put a ' into an input box to be added to my mysql database nothing happens

 

i.e

 

if i added 'today is thursday' nothing would get added

 

but if i added today is thursday it would work fine

 

many thanks

 

[PFMaBiSmAd]

All data put into a query needs to be escaped to prevent special characters from breaking the query or allowing sql injection. Use the mysql_real_escape_string() function on your data.

[discomatt]

Try echo'ing your query before you execute it, you'll find out why it's breaking.

 

mysql_real_escape_string() will be your solution

[sinista]

hey,

 

mysql_real_escape_string() worked perfectly, thanks so much guys,

 

changed

 

$sql = "INSERT INTO `comments` (`comment`, `date`, `user`, `blog_id`) VALUES ('$comment', '$datetime', '$user', '$blog_id')";

$result = mysql_query($sql)

 

to

 

$test = mysql_real_escape_string($comment);

$sql = "INSERT INTO `comments` (`comment`, `date`, `user`, `blog_id`) VALUES ('$test', '$datetime', '$user', '$blog_id')";

$result = mysql_query($sql)

 

thanks again guy