[SOLVED] format string

[jpratt]

I have quite a few field where the user may type in a' or a ". how do I format the string so it inputs it into the database appropriately? Thanks.

[teng84]

<?php

$str = "Is your name O'reilly?";

 

// Outputs: Is your name O\'reilly?

echo addslashes($str);

?>

 

also try

http://www.php.net/manual/en/function.mysql-real-escape-string.php

[pocobueno1388]

Definitely go with the mysql_real_escape_string() function, that is what is was made to do.

[jpratt]

$comment = $_POST['comment'];
$sql = "INSERT INTO medjournal (comment) VALUES ('$comment')";

 

Here is a sample. I cannot use mysql_real_escape_string as i am using a sqlite db using pdo.

 

Can anyone give me an example using this bit of code? Thanks.

[teng84]

$comment = addslashes($_POST['comment']);

$sql = "INSERT INTO medjournal (comment) VALUES ('$comment')";

[jpratt]

I tried addslashes, but it still gives an error when using ' but works fine inserting "

[teng84]

what ? is this solved already?

[jpratt]

no, im still getting an error when a ' is entered. I tried using addslashes but still get the error. addslashes worked for " but not '

[teng84]

http://www.php.net/manual/en/function.htmlspecialchars.php

 

try

[jpratt]

Thanks, that did it.