[SOLVED] Excluding Quotes (") from a MYSQL query to reduce problems

[jonoc33]

Hey guys.

 

I have a script which adds something to a database through a form. Whenever I add something that has quotes in it (") it causes the MySQL to have problems. What script would I need to remove quotes from the submitted form? Or is there any way to stop problems from happening but without removing the quotes?

 

<?php
include("config.php");

$con = mysql_connect("localhost","*****","***");
if (!$con)
  die('Could not connect: ' . mysql_error());
mysql_select_db("*****", $con);
$sql="INSERT INTO alpha_tactics (tacticname, map, tactics)
VALUES ('" . $_POST["tacticname"] . "','" . $_POST["map"] . "','" . stripslashes($_POST['tactics']) . "')";
$rs = mysql_query($sql) or die ("Problem with the query: $sql <br>" . mysql_error);
echo "<center>Record added.";
echo "<center><a href=admin.php>Back</a>";

?> 

 

Jono

[adam291086]

you could use a rich text editor to submitt the information. There is a free around.

[rajivgonsalves]

you should use mysql_real_escape_string for the $_POST variables

[revraz]

Put them into $variables before you put them in the sql query.  It will be much easier for you to use the correct quotation marks.

[jonoc33]

I am using a rich text editor, still doesn't work.

 

I am trying a variable now

[jonoc33]

EDIT:

 

Tried mysql_real_escape_string and putting them into variables. Still stuffs up the query.

[revraz]

Post an example of what the fields contain.  Are you using addslashes?

[jonoc33]

<img src="http://www.revolutiongamerz.net/images/global/vr.jpg" />

 

Notice how it contains quotes?

[Jessica]

You need to research "SQL Injection" to find out why you need to escape and sanitize data and sql statements, and you should find articles with techniques on how to fix your problem.

[jonoc33]

I am using mysql_real_escape_string to stop SQL Injections. Still does not work when I have quotes.

[Jessica]

Then you're not using it right...your code only shows stripslashes which will do the OPPOSITE. You don't have anything to escape data.

[mr_mind]

Try this

 

<?php
$db_host = 'localhost';
$db_pass = 'abc123';
$db_user = 'bob_jones';
$db_table = 'some_table';
include("config.php");
if(mysql_connect($db_host,$db_user,$db_pass)) {
	if(mysql_select_db($db_table)) {
		$tactic_name = mysql_real_escape_string($_POST['tacticname']);
		$tactic_map = mysql_real_escape_string($_POST["map"]);
		$tactic = mysql_real_escape_string($_POST['tactics']);
		$tactic_rows = array(tacticname,map,tactics);
		$tactic_values = array("'" . $tactic_name . "','" . $tactic_map . "','" . $tactic . "'");
		if(mysql_query("INSERT INTO alpha_tactics (" . $tactic_rows . ") VALUES (" . $tactic_values . ")")) {
			print '<center>Record added. <a href=admin.php>Back</a> </center>;
		}
		else {
			print mysql_error();
		}
	}
	else {
		print mysql_error();
	}
}
else {
	print mysql_error();
}
?> 

[jonoc33]

The reason i'm using striplashes is to output the rich text editor as HTML, which then goes into the database.

 

Would this code work if i'm using fckeditor with it?

 

EDIT:

I tried it out, and I got this error:

Unknown column 'Array' in 'field list'

[jonoc33]

I messed around with it and it works now (adds slashes). Although.

 

I have a script that gives the user an EDIT button to edit the tactic.

 

 print "<form name=\"form2\" method=\"post\" action=\"tacticedit1.php\">";
 print "<input type=\"submit\" name=\"button\" id=\"button\" value=\"Edit ".$values['tacticname']."\">";
     print "<input name=\"tacticname\" type=\"hidden\" id=\"tacticname\" value=\"".$values['tacticname']."\">";
 print "<input name=\"map\" type=\"hidden\" id=\"map\" value=\"".$values['map']."\">";
 print "<input name=\"tactics\" type=\"hidden\" id=\"tactics\" value=\"".$values['tactics']."\">";
     print "</form>";

 

Notice the last input how it has the Tactics in it. They are all hidden because they are needed for it to be edited.

Now, say if I made a tactic and put this into it:

 

<img src="vr.jpg" />

 

It will put it in right, but when you go and look at the edit button, under it it has

 

">

 

And if you hit the edit button, the picture will not show up.

 

What I still dont understand is how it still has problems even when it's added slashes.