[SOLVED] Syntax Error on text field

[RynMan]

Hey guys

 

I'm trying to insert some text from a textarea on a form, into a field in my SQL database.  The field that it Inserts into is a longtext field. 

 

It gives me this error:

 

Database query failedYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ....etc

 

Thing is, when I cut out a couple of paragraphs of text from the end (there's about 5 short paragraphs in total) it works fine. 

 

Anyone have any idea why I'm getting a syntax error with more text?

 

Here's my SQL...

 

$SqlInsert = "UPDATE tblothercv SET KAMClientID = $KamID, Display = $display, OtherCVDesc = '".$_POST["description"]."', ItemType = '$cvtype'
				  WHERE  WriterCVautoID = $CVOtherautoID " ; 

[PFMaBiSmAd]

It's probably what the text is, not how much of it.

 

ALL string data that is put into a query statement must be escaped to prevent SQL special characters from breaking the syntax of the query and to help prevent sql injection.

 

You need to use mysql_real_escape_string on any string data put into a query.

[phporcaffeine]

The value you are inserting most likely has characters in it that needs escaped.  Try this:

 

OtherCVDesc = '" . mysql_real_escape_string($_POST["description"]) . "'

 

Additionally, I would reconsider placing POST values directly inside a query without doing some sort of data sanitizing first.

 

 

//REMOVE LEADING AND ENDING SPACES AND SLASHES
$sanitize = trim(strip_tags(stripslashes($_POST["description"])));

//DEFINE OUR KNOWN BAD CHARACTERS
$badChars = array('@', '#', '$', '%', '^', '*', '(', ')', '<', '>', '{', '}', '[', ']');

//DEFINE WHAT WE WILL REPLACE EACH BAD CHARACTER WITH
$replaceChars = array('', '', '', '', '', '', '', '', '', '', '', '', '', '');

//REMOVE DANGEROUS CHARACTERS THAT WE KNOW DON'T NEED TO BE ANY THE STRING
$sanitize = str_replace($badChars, $replaceChars, $sanitize);

//ANY LAST REMAINING CHARS THAT NEED ESCAPED
$sanitize = mysql_real_escape_string($sanitize);

//ISSUE THE VARIABLE AS A VALUE TO THE QUERY
OtherCVDesc = '$sanitize'

 

 

[RynMan]

Ah perfect.    Works great - thanks guys!!!