Re: Re: Stuck in apostrophe hell
| From: | Karl DeSaulniers | Date: | Wed, 04 Aug 2010 00:24:52 +0000 |
| Subject: | Re: Re: Stuck in apostrophe hell | ||
| References: | 1 2 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-47288@lists.php.net to get a copy of this message | ||
On Aug 3, 2010, at 8:08 AM, Peter Lind wrote:
On 3 August 2010 15:04, <Paul_S_Johnson@mnb.uscourts.gov> wrote:VALUES = mysql_real_escape(VALUES); before submitting or something similar? maybe urlencode Karl DeSaulniers Design Drumm http://designdrumm.comYes, I may have mixed up the input and output from different iterations of running it. Let me try posting this again although it may not be an issue. Once again if I enter two sequential apostrophes in the name (O''Brien) the INSERT passes right through to MySQL without an error. THE INPUT: $sql_insert_registration = sprintf("INSERT INTO Registrations ( Class_ID, prid, Registrant, Company, Phone, Email ) VALUES ( $_POST[Class_ID], $_POST[prid], '%s',". parseNull($_POST['Company']).", '$_POST[Phone]', '$_POST[Email]' )", mysql_real_escape_string($_POST['Registrant'])); echo "<pre>$_POST['Registrant".$_POST["Registrant"]."</pre>"; echo "<pre>".mysql_real_escape_string($_POST["Registrant"])."</pre>"; echo "<pre>".$sql_insert_registration."</pre>"; THE OUTPUT: Brian O'Brien Brian O\'Brien INSERT INTO Registrations ( Class_ID, prid, Registrant, Company, Phone, Email ) VALUES ( 355, 257, 'Brian O\'Brien',NULL, '612-456-5678', 'somebody@somewhere.org' ) Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Brien', 'Class registration confirmation', ' This email ' at line 16Strangely, you have still failed to provide the input that is actually sent to mysql. Look at the error code: "... for the right syntax to use near 'Brien', 'Class registration confirmation', ' This email '" - "Class registration confirmation" does not appear anywhere in the output section you posted but it appears in the mysql error. I'd do as Bret suggested and turn on query logging in mysql to see what is actually received. Regards Peter --<hype> WWW: http://plphp.dk / http://plind.dk LinkedIn: http://www.linkedin.com/in/plind BeWelcome/Couchsurfing: Fake51 Twitter: http://twitter.com/kafe15 </hype> -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php Can't you just..