remove an apostrophe from users input

[dugen]

Hi,

I have created a form on a website that has a php handle. The handle inputs the data from the form fields into a mysql database.

Whenever a user enters an apostrophe into the form it causes the query to fail.

How can i make it so the code automatically deletes the apostrophe?

Thanks

 

[thedaver]

str_replace
preg_replace
ereg_replace
htmlentities


D.E.R. Management - IT Project Management Consulting

http://www.dermanagement.com/

 

[dkdude]

For this simple task I'd use str_replace :

<?php

$user_input = "This is char ' is about to be gone!";

echo "Now you see it : $user_input<br />\n";

$user_input = str_replace("'", "", $user_input);

echo "Now you don't : $user_input<br />\n";

?>

 

[dkdude]

Looks like you pressed submit before me, thedaver ;-)

 

[sleipnir214]

I wouldn't delete the apostrophe. I'd use to make the apostrophe insertable.

You should be using this function on all user input that you intend to insert into MySQL.



Want the best answers? [url=http://www.catb.org/~esr/faqs/smart-questions.html]Ask the best questions! TANSTAAFL!

 

[dugen]

HI,

Below is the code i tried... This does not seem to be working. The query fails when an ' is in the name text box (txtname)


$name = 'txtname';
$customer ='txtcustomer';
$comments = 'txtcomments';

$name = str_replace("'", "", $name);


//link to the db

$link = mysql_connect($host, $user, $password) or die (mysql_error());
Mysql_select_db("motion") or die(mysql_error());


//Insert text box values from form into the database
$query = mysql_query("INSERT INTO feedback_accounting (`name`, `customer_name`, `comments`) VALUES ('$_POST[$name]', '$_POST[$customer]', '$_POST[$comments]')");

//execute query
mysql_query(($query) or die('Error, query failed'));

 

[lgarner]

Unless you have register_globals turned off, $name and $_POST['name'] are different variables.

I second sleipnir's suggestion. It's easier, and there are other evils besides apostrophe's.

 

[sleipnir214]

Oops.

My earlier post should have read, in part:

mysql_real_escape_string()


That'll show me to use TGML without previewing.



Want the best answers? Ask the best questions! TANSTAAFL!