jeff5656 Posted August 4, 2011 Share Posted August 4, 2011 I tried to insert this variable into a database: stripslashes($del_array['t3']) When that variable contains a ' character (don't or O'Grady, etc) then I get the syntax error. If I don't have a ' then it inserts correctly. I thought wrapping the variable in stripslashes was supposed to escape the ' sign? Quote Link to comment Share on other sites More sharing options...
gizmola Posted August 4, 2011 Share Posted August 4, 2011 What database? Quote Link to comment Share on other sites More sharing options...
gizmola Posted August 4, 2011 Share Posted August 4, 2011 Also, stripslashes would be the opposite of what you want. When you add data to a database, you typically would addslashes. When you pull the data back out for display, then you stripslashes. This could also be affected by magic quotes which you would want to determine whether or not it is configured (although hopefully not) and depends on the type of software you're writing (is this generic, or something only you will use, and can safely ignore the magic quotes issue). Depending on the database, there are specific functions to use in lieu of addslashes. Quote Link to comment Share on other sites More sharing options...
AyKay47 Posted August 4, 2011 Share Posted August 4, 2011 if you are trying to escape special characters...stripslashes is the opposite of what you want..it does what its name infers...is takes out backslashes that escape characters, also if magic_quotes_gpc is on.. what you are looking for is mysql_real_escape_string Edit: darn it Gizmo... Quote Link to comment Share on other sites More sharing options...
jeff5656 Posted August 4, 2011 Author Share Posted August 4, 2011 Thanks to everyone. Yes I think I need to use addslashes. The variable comes from another table that I had inserted using mysql_real_escape_string(). Now I am taking that record and inserting it into table 2, so I need to use addslashed to get it in there. Actually sicne I originally put it in with mysql_real_escape_string(), couldn't I use that instead of addslashes? Quote Link to comment Share on other sites More sharing options...
xyph Posted August 4, 2011 Share Posted August 4, 2011 Not only can you, mysql_real_escape_string() is BETTER than addslashes() in this case. Quote Link to comment Share on other sites More sharing options...
AyKay47 Posted August 4, 2011 Share Posted August 4, 2011 Thanks to everyone. Yes I think I need to use addslashes. The variable comes from another table that I had inserted using mysql_real_escape_string(). Now I am taking that record and inserting it into table 2, so I need to use addslashed to get it in there. Actually sicne I originally put it in with mysql_real_escape_string(), couldn't I use that instead of addslashes? mysql_real_escape string is a bit smarter then addslashes in that it takes into account the charset of the db server, and escapes a few bitwise characters as well... Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.