CODEWITHSUNDEEP
phpmysql
xRobot
xRobot

Reputation: 26569

How to save this string in PHP?

When I save this string in PHP:

John: "Yes you can".

In my database is saved as:

John: \

How can I save these strings with " ( without deleting " obviously ). This is my php code:

$titlepost= mysql_real_escape_string($_POST['title']);
$query = "INSERT INTO `titles` (`title`) VALUES ( '".$titlepost."')";
$res = mysql_query($query) or die("Failed".mysql_error() );

echo $titlepost;

output: 
John: \\

FORM:

$title = mysql_real_escape_string($_GET['title']);

<form method="post" action="title.php?done=yes" enctype="multipart/form-data">
<input type="text" size="25" name="title" <?php echo "value=\"".$title."\""; ?> > 
<input id="starit" name="submit" value="titleit" type="submit" />
</form>

Upvotes: 1

Views: 2783

Answers (3)

Your Common Sense
Your Common Sense

Reputation: 157828

Your problem has nothing to do with PHP or MysQL.

It is as silly as very simple HTML syntax rule. It is quite obviously that the code 

<input value="John: "YES you can>

will show only quoted "John: " part. To make it correct, one have to encode special symbols in the value

$titlepost = htmlspecialchars($titlepost,ENT_QUOTES);
?>
<input type="text" name="title" value="<?=$titlepost?>">

As for the slashes - it is silly excessive quoting issue. just quote your strings only once and make sure you have magic_quotes_gpc turned off

Upvotes: 2

ThiefMaster
ThiefMaster

Reputation: 318468

If you really just get John: \ in your database, it sounds like you are using magic quotes (that causes you do insert backslashes in the database since you are escaping the escaped string) and the column size is way too small (that's why anything after the backslash is missing).

Try this:

if(get_magic_quotes_gpc()) $_POST = array_map('stripslashes', $_POST);
$titlepost = mysql_real_escape_string($_POST['title']);

This ensures that $_POST does not contain any magic-quotes-escaped data which would break after using mysql_real_escape_string.

Upvotes: 0

Tim
Tim

Reputation: 6441

Try using prepared statements from PDO

http://php.net/manual/en/pdo.prepared-statements.php

The parameters to prepared statements don't need to be quoted; the driver automatically handles this. If an application exclusively uses prepared statements, the developer can be sure that no SQL injection will occur (however, if other portions of the query are being built up with unescaped input, SQL injection is still possible).

Upvotes: -1

Related Questions