irish names in sql ??

[sudsy1970]

hi there,

 

I am using a form to submit first name, surname, username etc which i upload to a database.  Now i know that sql will throw a wobbly if i entered o'callaghan and that i would need to enter something like:

 

insert into users (surname) values ('O''Callaghan')

 

However how can i recognise that the surname has an apostrophe from the form and then correct it if the code section above how it should be entered.

 

the code for the form is simply

$Surname = $_POST['Surname'];

 

 

Also i can redirect back to the form if i find any errors in it using header() but how can i put a message to let people know why this has happened. i.e the passwords you supplied do not match, username name already in use etc.

 

Thanks for any suggestions

[Mchl]

Use proper escaping function. For mysql it's mysql_real_escape_string