Issue with ? in comment

[mcmuney]

I have the code below in a script where descriptions can be added to an image, which is referenced in the code as a comment. Everything seems to work fine, EXCEPT when there is a "?" in the comment, in which case, the second update doesn't execute. Any idea why and any solution to this problem?

 

$db->update("UPDATE `sc_member_images` SET ordering=-1 WHERE scm_mem_id='{$social_mem_id}'");
for($i=0;$i<count($_POST['p']);$i++)
{
$q="UPDATE `sc_member_images` SET ordering='".($i+1)."',sci_caption='".addslashes($_POST['p'][$i][comment])."' WHERE sci_id='{$_POST['p'][$i][image]}'";
$db->update_data($q)or die(mysql_error());
}

[trq]

Don't use user inputed data directly in database queries anyway, your opening all sorts of cans of worms in relation to security issues.

 

What database engine are you using there? Surely it has mechanisms for escaping data properly?

[mcmuney]

It's a mysql database. It's a text field, but I'm not sure why the ? would be an issue.