CODEWITHSUNDEEP
phpmysqlhtml-sanitizingsanitization
cppit
cppit

Reputation: 4564

special characters break mysql insert

I have a mysql statement like this:

mysql_query("INSERT INTO movies (comments, description, synopsis)
VALUES ('$_POST["comments"]', '$_POST["desc"]',$_POST["synopsis"])");

very simple and straightforward as you can see. The issue is when I enter special characters to the form, it doesnt insert the data to my table (using phpmyadmin to check directly if it was inserted). for example if i put in comments textarea this value: "this is a comment" this works if I put instead: "what's your name? : John doe is my name" it breaks.I know its because mysql uses the characters... any suggestions on what I should do ?

Upvotes: 0

Views: 5931

Answers (3)

dsafsdd
dsafsdd

Reputation: 1

$comments = mysql_real_escape_string($_POST['comments']);
$desc = mysql_real_escape_string($_POST['desc']);
$synopsis = mysql_real_escape_string($_POST['synopsis']);

mysql_query("INSERT INTO movies (comments, description, synopsis)
VALUES ('$comments', '$desc', '$synopsis'");

Upvotes: 0

Ata S.
Ata S.

Reputation: 900

$comments = mysql_real_escape_string($_POST['comments']);
$desc = mysql_real_escape_string($_POST['desc']);
$synopsis = mysql_real_escape_string($_POST['synopsis']);

mysql_query("INSERT INTO movies (comments, description, synopsis)
VALUES ('$comments', '$desc', '$synopsis'");

For more information google "php addslashes", or look at this page looks explanatory http://www.tizag.com/mysqlTutorial/mysql-php-sql-injection.php

Upvotes: -1

Kenny Thompson
Kenny Thompson

Reputation: 1492

mysql_query("INSERT INTO movies (comments, description, synopsis) 
VALUES ('".mysql_real_escape_string($_POST["comments"])."', '".mysql_real_escape_string($_POST["desc"])."','".mysql_real_escape_string($_POST["synopsis"])."'");

Upvotes: 7

Related Questions