insert single quote problem

[wtp]

hi all,

 

is it possible that insert the single quote character into MySQL?

 

regards

stephen

[Mchl]

Yes there is

mysql_real_escape_string

[wtp]

it will have slash before the single quote right?

it not very nice look. can remove the slash?

[Mchl]

The slash is only there to tell MySQL, that there's a special character right after it. When the data is inserted into MySQL, the slash is no longer there.

[wtp]

The slash is only there to tell MySQL, that there's a special character right after it. When the data is inserted into MySQL, the slash is no longer there.

 

i got a problem here.

 

user insert single quote character into database ( now can insert into database).

when retrieve the data (i can retrieve data from database).

then i have to post the single quote character to URL, so that i can retrieve rest of the information from database. so can i post single quote character to URL using php? or using others way to do it?

 

 

 

 

 

[Mchl]

Please explain.

Perhaps you could show us some code concerning the problem...

[wtp]

below code is to display the contain from database and for user to select which activity want to edit and post it to URL.

 

  $sql="select * from activity";
  $query=mysql_query($sql);
  while($menu=mysql_fetch_array($query)){				
    $t = mysql_real_escape_string($menu['a_title']);
    $t = stripslashes($t);
    echo "<option value='$t'>$t</option>";
  }

 

below is to get the information from URL to display rest of infomation from database.

 

if($_GET['choose'] != NULL){
$choose=$_GET['choose'];
$s="select * from activity where a_title= '$choose'";
$q=mysql_query($s) or die (mysql_error());
$r=mysql_fetch_array($q);
$date1=mysql_real_escape_string($r['a_date']);
$title1=stripslashes($r['a_title']);
$desc1=stripslashes($r['a_desc']);
}

[trq]

You escape data on the way into the database, not out of the database.

[wtp]

You escape data on the way into the database, not out of the database.

 

you means the first code or second code?

sorry, im newbie. (

[trq]

you means the first code or second code?

 

Considering there both using SELECT queries to retrieve information from a database, neither.

[Mchl]

you means the first code or second code?

 

Considering there both using SELECT queries to retrieve information from a database, neither.

 

Actually, int the second piece of code $choose variable should go through mysql_real_escape_string to avoid possible SQL injection. Variables retrieved from query need not be passed through this function.

[wtp]

is it below what you means?

 

$sql="select * from activity";
$query=mysql_query($sql);
while($menu=mysql_fetch_array($query)){				
$t = $menu['a_title'];
echo "<option value='$t'>$t</option>";
}

 

if($_POST['choose'] != NULL){
$choose=mysql_real_escape_string($_POST['choose']);
$s="select * from activity where a_title= '$choose'";
$q=mysql_query($s) or die (mysql_error());
$r=mysql_fetch_array($q);
$date1=$r['a_date'];
$title1=stripslashes($r['a_title']);
$desc1=stripslashes($r['a_desc']);
}

[wtp]

my problem is a_title containing single quote from database eg: ab'cde

when come to second code, i echo $_POST['choose'] , it only show ab.

 

[mandred]

Escape every single variable then.