SQL INSERT - PHP variables with quotes on the text 2

[HugoLeite]

Hi! I'm a ASP programmer and i'm giving my first steps to use PHP and I already have a problem, it was like this:

I have a form with name, e-mail and post for example.

The name is -> MyName
and
Supose that someone's post is -> I am an ASP programer, and I do not know how PHP works.
the SQL statement would work fine, but imagine that the post was something like -> I'm an ASP programer and I don't know how PHP works.

My problem is that when I do this:

function insertForm($txt_name,$txt_post){
$query="INSERT INTO table_name(id, desc) VALUES('$txt_name','$txt_post')";
$result=$this->cDb->executeQuery($query);
return $result;
}

if the post has quotes( ' ) the SQL statement would be INSERT INTO table_name(id, desc) VALUES('MyName','I'm an ASP programer and I don't know how things work.')

When it tries to insert the post, the red quotes will generate an error, and I can't block the use of them, I can't remove them, or replace them for a code such as \Quote , and when I displayed the text I would replace \Quote for ' , I can't do this because my 'BOSS' doesn't wants this 'TYPE' of solutions...

I don't know if it really generates an error, but my boss said it would and told me to search for a solution. And I just said: "You are the boss, boss" and I have been trying, but 0 finds till now. I do not even have a database to test some solutions.

I have tried to find a function that would just ignore the ( ' ) but unfortunately I don't understand English so well and and all the Notes that I see in

http://www.php.net

are in English and to block the fobidden chars that we want...., not to ignore them.
I know that there is a way, because when I'am posting this, it as ' quotes either and it doesn't generates any error...
If there ain't, I hope someone could tell me if substituing ' with the respective HTML is the best solution as I think it is....

I'm really hopping you can help me...

thank you, at least for having the patience to read this...

 

[skiflyer]

What you're going to want is to escape the single quote... so

INSERT INTO table_name (id, desc) VALUES ('MyName', 'I\'m an ASP programmer and I don\'t know how things work.')

Should do just fine. And should return a nice normal string with no slashes with a simple select statement.

-Rob

 

[skiflyer]

Oh, and a hint on how to format SQL strings that are just obnoxious... download a copy of phpMyAdmin, and use the insert tab there to insert a value, then type that value in by hand. The SQL string used will be displayed.

-Rob

 

[sleipnir214]

PHP provides multiple functions for handling this problem.

If your database backend is MySQL, then mysql_escape_string() (

http://www.php.net/manual/en/function.mysql-escape-string.php).

If PostgreSQL, then use pg_escape_string() (

http://www.php.net/manual/en/function.pg-escape-string.php)

There's also a more general function, addslashes() (

http://www.php.net/manual/en/function.addslashes.php).

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[HugoLeite]

Thank you for having the time to read my doubt, and for being so fast, I really apreciate you help...

Thanks to all.........

 

[HugoLeite]

It worked fine, thank you, but, what would
I have to do if I didn't wanted to store it
in a database, but POST it to another page.
I have tried this and it escapes the characters,
but wen i ECHO it it displays the slashes, how can I remove the slashes, is there any function? Because I know that PHP has a lot of functions, it's good, but on the other hand it makes it quite dificult to find just the one you need...

Sorry being such a pain in the ass....

 

[sleipnir214]

Which function did you use to add the slashes?

If you used addslashes(), you might take a look at stripslashes() (

http://www.php.net/manual/en/function.stripslashes.php)

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[HugoLeite]

I figured out that if I didn't use any function at all when I was using a FORM with a POST or GET method, it would do just fine, if I didn't wanted the data stored.

But If I want to store the data in a database, I'm going to have to use a function that escapes bad input, and if when I am getting the data out of a database, it is going to be necessary to use a function to remove the slashes, I'm going to use stripslashes(), after I have used addslashes()..., just have to check the security of both functions...

...and expect my boss will aprove them.

tks

 

[sleipnir214]

Actually, when you use addslashes to insert data into a database, the data coming out can be used as-is. The escape characters allow the database parser to correctly insert the bad characters into the datbase -- but the characters are not part of the data itself.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[skiflyer]

Another tip for using Tek-Tips for PHP help (at least I find it really useful)... when someone points you to a function like addslashes(), go to

http://www.php.net

and enter the function in the search field.

Then pay special attention to the "see also" line just before the comments. You'll pick up all sorts of useful knowledge that way. Doing so for addslashes reveals the stripslashes function for example... though more interestingly, as sleipnir pointed out, that's not necessary in this particular example.

-Rob