php mysql text box error

[mrooks1984]

---

hello all, i am hoping someone would be kind enough to help me.

the form and code works fine, until i add a ' for e.g. michael's and when i click the submit i get this error:

 

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's','home')' at line 3. the mysql filed is set as text.

 

the php code:

function content_add() {

   		$sql="INSERT INTO content (title, body, page)
	VALUES
	('$_POST[title]','$_POST[body]','$_POST

---

')";

	if (!mysql_query($sql))
	 	{
  		die('Error: ' . mysql_error());
  		}
		echo "<script>window.location='index.php?option=content'</script>";
}

 

just hoping someone can help me fix this issue, thanks all.

[cunoodle2]

You are missing some code.  Please show us the actual code at line #3 which is where php says the issue is..

"MySQL server version for the right syntax to use near 's','home')'"

 

I'm guessing that you may have an older version of mysql or something.  However, I would need to see your code to even begin troubleshooting this.

[PFMaBiSmAd]

The line number mentioned in the mysql error message is the line of the query statement where the error occurred.

 

All string data that is put into a query statement must be escaped. See this link - mysql_real_escape_string

[mrooks1984]

thanks for your responce, here is the code for the form file:

 

<script type="text/javascript" src="js/nicEdit.js"></script> 
<script type="text/javascript">
bkLib.onDomLoaded(function() { nicEditors.allTextAreas() }); 
</script> 
<div id="title_bar">
<div id="title">
<h1>Content Manager: Add Content</h1>
</div>
</div>
<div id="content_bar">
<h2>Add Content</h2>
<div id ="content_form">
<form method="post" action="">
     <div id="content_title">
     <label for="title">Title:</label>
     </div>
     <div id="content_box">
    <input type="text" name="title" id="title" />
    </div>
    <div id="content_title">
    <label for="page">Page:</label>
    </div>
    <div id="content_box">
    <?php $res = mysql_query("SELECT * FROM page ORDER BY ID") or die(mysql_error());  
    echo "<select name = \"page\">";  
    while($row=mysql_fetch_assoc($res)) {  
        echo "<option value=\"$row[name]\"> $row[name]</option>";  
    }  
    echo "</select>";
 ?> 
  	</div>
    <div id="content_title">
    <label for="body">Body:</label>
    </div>
    <div id="content_body">
    <textarea name="body" id="body" rows="10" cols="100"></textarea>
     </div>
            <div id="content_body">
<input type='submit' name='submit' value='Add Content'>
    </div>
  </form>
</div>
  <?php 
if(isset($_POST['submit']))
{
$obj->content_add();
}
?>
</div>

 

and the function it uses is the one above.