OsirisElKeleni Posted October 5, 2014 Share Posted October 5, 2014 (edited) Hello everyone, I have a card database and everything works perfectly besides one thing.. I can't store ' in my database via my form, i however do can store them into the database via PHPMyAdmin. I dont know what i've been doing wrong and it really bothers me. If any of you guys could help me out. Here's all the code you would need to find the issue. This is the form file <!doctype html> <html> <head> <meta charset="utf-8"> <title>Edit Page</title> </head> <body> <h1 align="center"> Add Cards</h1> <form action="insert.php" method="POST"> <input type="text" name="name" placeholder="Name" /> <input type="text" name="color" placeholder="Color" /> <input type="text" name="type" placeholder="Type" /> <input type="text" name="subtype" placeholder="Sub Type" /> <input type="text" name="power" placeholder="Power" /> <input type="text" name="toughness" placeholder="Toughness" /> <br> <input type="text" name="manacost" placeholder="Converted Mana Cost" /> <input type="text" name="rarity" placeholder="Rarity" /> <input type="text" name="expansion" placeholder="Expansion" /> <input type="text" name="foil" placeholder="Foil" /> <input type="text" name="stock" placeholder="Stock" /> <input type="submit" value="Save" /> </form> </body> </html> This inserts it into my database. <?php ($GLOBALS["___mysqli_ston"] = mysqli_connect("", "", "", , ))or die("cannot connect"); ((bool)mysqli_query($GLOBALS["___mysqli_ston"], "USE e_industries"))or die("cannot select DB"); $name = $_POST['name']; $color = $_POST['color']; $type = $_POST['type']; $subtype = $_POST['subtype']; $power = $_POST['power']; $toughness = $_POST['toughness']; $manacost = $_POST['manacost']; $rarity = $_POST['rarity']; $expansion = $_POST['expansion']; $foil = $_POST['foil']; $stock = $_POST['stock']; $sql="INSERT INTO Osiris (Name, Color, Type, Subtype, Power, Toughness, Manacost, Rarity, Expansion, Foil, Stock) VALUES ('$name', '$color', '$type', '$subtype', '$power', '$toughness', '$manacost', '$rarity', '$expansion', '$foil', '$stock')"; $result=mysqli_query($GLOBALS["___mysqli_ston"], $sql); if($result){ echo "Successful"; echo "<BR>"; echo "<a href='add.html'>Back to main page</a>"; } else { echo "ERROR"; } ?> If anyone could help me out that would be great! Edited October 5, 2014 by OsirisElKeleni Quote Link to comment Share on other sites More sharing options...
Solution Barand Posted October 5, 2014 Solution Share Posted October 5, 2014 You should never write data provided by users directly to the database without escaping it with mysqli_real_escape_string() to sanitize it. Or, better still, use prepared queries. Amongst other things, this will take care of the apostrophe problem for you. Quote Link to comment Share on other sites More sharing options...
OsirisElKeleni Posted October 5, 2014 Author Share Posted October 5, 2014 The data will only be stored by me and some friends but if that solves the problem i will look into how to do that (beginner) Thanks ill post the result! Quote Link to comment Share on other sites More sharing options...
OsirisElKeleni Posted October 5, 2014 Author Share Posted October 5, 2014 That worked like a charm Thanks! Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.