Error

[jj20051]

Ok I Wrote This Script To Copy Data From One Table To Another...

I Recognize The URL At The End From Being In The oDescription Variable.

 

 

I Get This Error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'http://trientanetwork.directtrack.com/z/407/CD643/">

 

Here Is The Code:

$db->query( 'INSERT INTO completedoffers (uID, coTitle, coPrice, coSite, coDescription) VALUES("' . $data[0]["uID"] . '", "' . $data[0]["oTitle"] . '", "' . $data[0]["oPrice"] . '", "' . $data[0]["oSite"] . '", "' . $data[0]["oDescription"] . '")');

[thebadbad]

Looks like the URL has "> at the end, which is messing with the query where you use double quotes.

[jj20051]

The Code Is A Banner URL

[jj20051]

So How would I Make It Accept Whatever Is Put In?

[thebadbad]

Use mysql_real_escape_string() on any input to be used in a query. And I would use single quotes in the SQL, much easier when dealing with variables too:

 

<?php
//run variables through mysql_real_escape_string() here
$db->query("INSERT INTO completedoffers (uID, coTitle, coPrice, coSite, coDescription) VALUES('{$data[0]['uID']}', '{$data[0]['oTitle']}', '{$data[0]['oPrice']}', '{$data[0]['oSite']}', '{$data[0]['oDescription']}')");
?>