CODEWITHSUNDEEP
mysql
Md Johirul Islam
Md Johirul Islam

Reputation: 5162

Inserting TEXT in mysql database showing error

I have come to a weird problem. I have a text column in my table. I am inserting text taken from a textarea of html form into mysql database.

$sql="INSERT INTO mytable ( `username`, `firstname`, `lastname`,`about`,`email`) VALUES ('$username', '$fname', '$lname','$about','$email');";

about here is TEXT type column
And this is my textarea

<textarea id="oabout" name="about" rows="10" placeholder="Aboutyourself"></textarea>

If i insert the following text then the insertion works fine

I am a student

But if i try to insert the following text i am getting error

I'm a student

The error is shown as

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'm a student','[email protected]')' at line 1

How can i make the change so that the second text is also inserted into the database?

Upvotes: 0

Views: 637

Answers (1)

mat1010
mat1010

Reputation: 847

the issue seems to be that your single quotes are not being escaped. In case you are using PHP this module will take care to escape everything that needs to be escaped in you input string: https://www.php.net/manual/en/pdo.quote.php

Untested example for your usecase, the $conn has to be you mysql connection string:

<?php
$conn = new PDO('sqlite:/home/lynn/music.sql3');
$about = 'I'm a student';
$quotedAbout = $conn->quote($about);
print $quotedAbout;
?>

Basically you just have to call the $conn->quote($someVariable) for every of your TEXT fields that you want to be automtaically escaped.

Best regards,

Upvotes: 1

Related Questions