RE: trying to escape ' within a string (CMS related)

[zhTonic]

Hey guys,

 

I'm having some problems with using ' in a word like "they're" so i was trying to use $subject = str_replace("'","\'",$subject); so that it would escape the ' but that's not working for me.. I've tried a few different things but no luck, any help would be appreciated.

 

Thanks,

 

-Tc

[DarkWater]

You'll want to use mysql_real_escape_string() on EVERY piece of data that enters a database.

[zhTonic]

this is just the top part of the code, is there anything wrong here that is causing my problem?

 

function editnotice($username){
$requiredauth = 2;
if(!$username){
header("Location: _index.php");
} else {
$gmcheck = mysql_query("SELECT * FROM accounts WHERE name='".$username."'");
$gmchecky = mysql_fetch_array($gmcheck);
if($gmchecky["webadmin"] < 1){
header("Location: _index.php");
} else {
echo "<font size=2>";
if($gmchecky["webadmin"] < $requiredauth){
echo "Sorry, but you need to be at least a level $requiredauth GM. You are currently a level ".$gmchecky["webadmin"]." GM.<p>
This page has been disabled for your account.";
} else {
$post = mysql_real_escape_string($_GET["notice"]);
$sql1 = mysql_query("SELECT * FROM notices WHERE id='".$post."'");
$sqlly1 = mysql_fetch_array($sql1);
$subject = mysql_real_escape_string($_POST["subject"]);
$body = mysql_real_escape_string($_POST["body"]);
$back = "<a href='?action=editnotice&notice=$post'><font color=white>Back</font></a>";
$deleteit = mysql_real_escape_string($_POST["deleteit"]);
$subject = str_replace("'","a",$subject);
if($_POST){
if((empty($subject)) || (empty($body))){
echo "$font <font color=yellow>One or more fields are empty.</font><p>$back";
} else {
if(!$deleteit){
mysql_query("UPDATE notices SET topicname='".$subject."',topicsubject='".$body."' WHERE id='".$post."'") or die(mysql_error());	
  header("Location: _index.php");
} else {
mysql_query("DELETE FROM notices WHERE id='".$post."'") or die(mysql_error());
  header("Location: _index.php");

[DarkWater]

Okay, does it work now? o_O

[zhTonic]

Okay, does it work now? o_O

 

No this is how my code looked originally lol i always use mysql_real_escape_string on everything..

[DarkWater]

And does it show any MySQL errors when using a string with a ' in it?

[zhTonic]

And does it show any MySQL errors when using a string with a ' in it?

 

Not at all it just shows up as "they\'re ?"

 

*EDIT*

 

I just tried the same thing on my laptop wamp and when i use ' it formats it properly.. could this be a php/mysql thing?

[zhTonic]

I notice that the actual \ is being inserted right into the DB too.... hmm.