[SOLVED] apostrophe is hosing my mysql insertion

[86Stang]

I'm pretty new to alot of this so bear with me.

 

I am importing data into my mysql db as follows:

 

$import="INSERT into classifieds(cat_name,description) values('$name','$ad')";

mysql_query($import) or die(mysql_error());

 

It works fine until it gets to a row that has an apostrophe in the description at which point it kicks out

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's Heating is looking for exp. installers, trainees, and gas pipers in residentia' at line 1

 

Any ideas what I can do short of replacing the apostrophies?

[paul2463]

try this

 

$amendName = addslashes($name);
$amendAd = addslashes($ad);
$import="INSERT into classifieds(cat_name,description) values('$amendName','$amendAd')";

mysql_query($import) or die(mysql_error());

[Wildbug]

Yep.  You need to escape the strings (indented for legibility):

 

$import=sprintf("INSERT into classifieds(cat_name,description) values('%s','%s')",
mysql_real_escape_string($name),
mysql_real_escape_string($ad)
);

 

This also has the benefit of making your queries less suseptible to injection-type mischief.

[86Stang]

Worked like a charm, thanks guys!!