Replacing Invalid Characters in mySQL Table Using PHP

[Wickersty]

Hi,

Let's say I've got a mySQL Table with 5 text-type fields. A user fills out a standard HTML form, entering the text data s/he wants to store in these mySQL fields.

When I process the form using PHP, I want to make sure that the data does not contain any characters that would screw me up... characters like ' and " and ; etc.

Any advice would be greatly appreciated.

Thanks,

Jeff

 

[Bastien]

quotemeta

http://ca2.php.net/manual/en/function.quotemeta.php

Bastien

cat, the other other white meat

 

[KempCGDR]

or htmlspecialchars($string, ENT_QUOTE);

 

[DRJ478]

Wickersty,

Both answers above address the problem by encoding the offending characters. They do not remove or check for the existence, they just convert them.

If you want to exclude those characters from the text fields you should use a regular expression that removes checks for them.

It is not entirely clear from your question if converting the characters is what you want, or if it is removal.

 

[Wickersty]

I could just remove them, like the above mentioned suggestions would do. I'd like to convert them, though. Is it possible to convert, say a ' to a "safe" '

???

Thanks for the replies, all...

Jeff

 

[DRJ478]

Ok,

quotemeta() and htmlspecialchars() are encoding functions that convert characters that might offend to quoted characters or entities.

Since you are using MySQL it is probably best to use:

http://ca2.php.net/manual/en/function.mysql-escape-string.php

This makes the entered text MySQL safe.

 

[skiflyer]

Yeah, there're a couple possibilities here, and I'm not sure which you're getting at.

You need to make the string mysql safe to get it into the database, then you'll need to make it HTML safe to display it on the web page. Fortunately for you, all the necessary functions are listed above

Good luck,
Rob

 

[Wickersty]

Thanks all. I'll try your suggestions tonight and let you know how it works out. I appreciate the guidance.

Jeff