Stupid quotes

[matthew798]

Hey,

 

I have a form where an admin can enter a news story and it will be stored in a database and then retrieved when someone opens the news page... Now im sure this is an obvious answer, but how would i go about making it possible to use single and double quotes inside the post without affecting the mysql query?

[kenrbnsn]

You want to use the function mysql_real_escape_string on the data when you insert it into the database.

 

Ken

[lisa71283]

mysql(i)_real_escape_string() should be called on any user-supplied or modifiable content that will be passed to a query, otherwise you will be setting yourself up for a SQL injection attack.

[matthew798]

mysql_query("UPDATE news SET title='$title', body='$body' WHERE id='$id'",
mysql_real_escape_string($title),
mysql_real_escape_string($body));

 

i know something is wrong there...

 

Warning: Wrong parameter count for mysql_query() in C:\Program Files\EasyPHP 2.0b1\www\admin\newseditprocess.php on line 13

 

Never used this rel escape thingy before...

[darkfreaks]

<?php
$id.=mysql_real_escape_string($id);
$title.=mysql_real_escape_string($title);
mysql_query("UPDATE news SET title='$title', body='$body' WHERE id='$id'");
?>

[matthew798]

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' \"\' \'\'\' \"\' \"\'', body='" '" '" '" '" ' \" \'\" \'\" \'\" \'\" \' ' WHE' at line 1

 

I just treid a ****load of quotes....

 

This is what i have 

 

$id.=mysql_real_escape_string($id);
$title.=mysql_real_escape_string($title);
$body.=mysql_real_escape_string($body);
mysql_query("UPDATE news SET title='$title', body='$body' WHERE id='$id'")  
or die(mysql_error()); 

 

Also, is there something special i need to do to remove the slashes when i'm displaying the data?

[matthew798]

bump, because im an impatient prick with no regard for anyonw else...

[kenrbnsn]

The code that you used is incorrect, try this instead:

<?php
$id = mysql_real_escape_string($id);
$title = mysql_real_escape_string($title);
$body = mysql_real_escape_string($body);
$q = "UPDATE news SET title='$title', body='$body' WHERE id='$id'";
mysql_query($q) or die("Problem with the query: $q<br>" . mysql_error());
?>

 

You use the function stripslashes() to remove the added slashes.

 

Ken

[matthew798]

Thanks so much ken! I think i'm going to donate to PHP Freaks, i have gotten so much out of this community! Cheers boys! I'd buy you all a beer if i could