CODEWITHSUNDEEP
phpsqldatabasepostgresql
Mihai Bujanca
Mihai Bujanca

Reputation: 4219

String seems to end query

I am storing user's liked pages from facebook in my postgres database, one of them being Sinead O'Connor's page. It seems like when it gets to the apostrophe, it terminates the query beacuse the apostrophes match and therefore results in an error:

  $json_likes=json_encode($likes);
  echo $json_likes;
  $query = "UPDATE public.account_recover_users SET user_likes='$json_likes' WHERE user_mail='$email'";
  $result = pg_query($query);
  if(!$result)
      exit('{ "status": false }');
  else exit('{ "status": true }');

Now what I get here is :

Warning: pg_query() [<a href='function.pg-query'>function.pg-query</a>]: Query failed: ERROR: syntax error at or near &quot;Connor&quot; LINE 1: ...l&quot;,&quot;page_id&quot;:&quot;243440865683470&quot;},{&quot;name&quot;:&quot;Sinead O'Connor&quot;,&quot;p...

Any idea how should I handle this? My app's users might have all sorts of charachters in their liked pages.

Upvotes: 2

Views: 276

Answers (2)

Geeky Guy
Geeky Guy

Reputation: 9399

Just be glad you're not trying to store the page for Bobby Tables. Your app is vulnerable to SQL Injection - do escape apostrophes, for your own good.

TL;DR: the apostrophes in the text you're appending are being matched to the ones hard coded in your application, malformatting the SQL command. Hence the error.

Edit: moving this here from the comments. Here is a good guide on how to prevent SQL Injection in PHP

Upvotes: 5

Maxim Khan-Magomedov
Maxim Khan-Magomedov

Reputation: 1336

You have single quote in json string and it breaks the query. Use at least addslashes($json_likes) and addslashes($email)

Upvotes: 0

Related Questions