Hi All,
I am developing a simple address book using PHP and MySQL on a UNIX box
running Apache.
I'm getting errors when I try to add a record that has an apostrophe (
' ) in it. For example: when I go to my add_record.html file, which
contains a form with text fields to populate a new record, and I type
Nick's Books in one of the fields and submit the record ... which calls
my add_record.php file which has the neccesary INSERT command to create
the record, I get an error.
Any idea why? I know this has something to do with adding data with an
apostrophe in it, but I don't know to avoid this ... escape the
user-entered apostrophe, etc.
Use addslashes().
$query = "INSERT INTO tbl_name SET col_name = '" . addslashes ($var) . "'";
Note that you still need to supply the apostrophes around the value.
That constrasts with, e.g., DBI placeholders or quote() method.
--
Paul DuBois, paul@snake.net