Mysql Error When Text Field Has '

[derekshull]

I have the following code below and my problem is that in the description field if someone puts a ' (like when they use can't or won't or don't) it has an error....because it makes it act like the query is ending...how do I fix this?

 

global $user;
$needsusername = $user->name;

$needsip = $_POST['ip'];
$firstname = $_POST['firstname'];
$city = $_POST['city'];
$state = $_POST['state'];
$phone = $_POST['phone'];
$email = $_POST['email'];
$typeofneed = $_POST['typeofneed'];
$description = $_POST['description'];
$orgname = $_POST['organizationname'];
if (!mysql_query("INSERT INTO needs (firstname, city, state, phone, email, typeofneed, description, needsip, needsusername, orgname) VALUES ('$firstname', '$city', '$state', '$phone', '$email', '$typeofneed', '$description', '$ip', '$needsusername', '$orgname')")) {
die('Error: ' . mysql_error());
}

[ManiacDan]

mysql_real_escape_string. Use it on every single string input.

[derekshull]

Where do I need to put that? I very new to php and sql

[derekshull]

Nevermind I figured it out. Thanks!

[JohnTipperton]

$needsip = $_POST['ip'];

 

change it to

 

$needsip = mysql_real_escape_string($_POST['ip']);

Edited October 20, 2012 by JohnTipperton