Single Quote error?

[ajicles]

I have my script:

 

<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("youtube", $con);

$sql="INSERT INTO submitvid VALUES('','$_POST[link]','$_POST[title_video]','$_POST[video_description],'$_POST[video_tags]','$_POST[match_type]','$_POST[match_score]','$_POST[match_map]','$_POST[youtube_account]','$_POST[email_address]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "Your Video Has Been Submitted!";

mysql_close($con)
?> 

 

And I use html form tag to post data into the variable and then that goes into mysql data base. The error is if I use a single quote in the form it returns a error:

 

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 've been a good gameplay, but it gets ruined. I thought I'd put it up anyways tho' at line 1

 

I had to use the single quote in php to call the variable to send it off to the Database.

 

Is there a possible way to fix this? Or is there a way to remove certain characters from the data coming from the form?

 

Thanks

    ~AJ

[mrMarcus]

You're missing a ' after ... '$_POST[title_video]','$_POST[video_description] <--right here

[jcbones]

To answer your question.

 

In order to use quotes in forms you must escape the string.  You should do this no matter what.

 

Your script currently deploys ZERO string sanitation.  You should check for expected input, and also strip out any javascript, or other possible malicious code.  At the very least you should be running your $_POST variables through mysql_real_escape_string().

[ajicles]

You're missing a ' after ... '$_POST[title_video]','$_POST[video_description] <--right here

 

Thank you very much. I just learn php with mysql from Lynda.com. Still newby at it lol.

[ajicles]

Here is a copy of my project files. Its pretty simple.

 

[attachment deleted by admin]