Cleaning form text for database insertion

[Mutley]

Just a small issue, my form isn't working because there are some bad characters in the content being submitted.

 

I've tried htmlentities() and stripslashes() but it still comes up with errors when I test the echoed SQL. Is there a way to clean it? I will be using HTML in the content boxes so this still needs to work once displayed on the site from the database.

 

<?php
$cat_id = ($_POST['cat_id']);
$title = ($_POST['title']);
$content = ($_POST['content']);
$sql = "INSERT INTO blog (cat_id, date, title, content) VALUES ('$cat_id', '', '$title', '$content')";

mysql_query($sql);
?>

 

Thanks in advance.

[BlueSkyIS]

$sql = "INSERT INTO blog (cat_id, date, title, content) VALUES ('".mysql_real_escape_string($cat_id)."', '', '".mysql_real_escape_string($title)."', '".mysql_real_escape_string($content)."')";

[Orio]

Try this way:

 

<?php

$cat_id = cleanup($_POST['cat_id']);
$title = cleanup($_POST['title']);
$content = cleanup($_POST['content']);
$sql = "INSERT INTO blog (cat_id, date, title, content) VALUES ('$cat_id', '', '$title', '$content')";

mysql_query($sql) or die(mysql_error()."<br><br>".$sql);

function cleanup ($value) 
{ 
if(get_magic_quotes_gpc())
	$value = stripslashes($value);
$value = htmlentities(mysql_real_escape_string($value));
return $value;
}

?>

 

 

If it doesn't work- what error are you getting?

 

Orio.

[Mutley]

Thanks Orio, that works but... it displays all the HTML tags when I display it on the website?

[Mutley]

$sql = "INSERT INTO blog (cat_id, date, title, content) VALUES ('".mysql_real_escape_string($cat_id)."', '', '".mysql_real_escape_string($title)."', '".mysql_real_escape_string($content)."')";

 

Tried this way, which works, thanks a lot guys!

[Orio]

Thanks Orio, that works but... it displays all the HTML tags when I display it on the website?

 

I thought that if you're inserting something into a blog, it should go through htmlentities().

Anyway, the solution you are now using may escape twice so do something like this (much cleaner..):

 

<?php

$cat_id = cleanup($_POST['cat_id']);
$title = cleanup($_POST['title']);
$content = cleanup($_POST['content']);
$sql = "INSERT INTO blog (cat_id, date, title, content) VALUES ('$cat_id', '', '$title', '$content')";

mysql_query($sql) or die(mysql_error()."<br><br>".$sql);

function cleanup ($value) 
{ 
if(get_magic_quotes_gpc())
	$value = stripslashes($value);
$value = mysql_real_escape_string($value);
return $value;
}

?>

 

Orio.