Re: mysql_real_escape_string() and "
| From: | Michiel Sikma | Date: | Fri, 14 May 2010 21:42:52 +0000 |
| Subject: | Re: mysql_real_escape_string() and " | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-305227@lists.php.net to get a copy of this message | ||
On 14 May 2010 22:03, Spud. Ivan. <spudmixe@hotmail.com> wrote:
>
> I'm trying to insert a serialized data into mysql, but I does
> mysql_real_escape_string() before inserting it.
>
> INSERT IGNORE INTO
table
> (value) VALUES
>
> ('a:3:{s:12:"F1";s:6:"nombre";s:11:"F2";s:5:"F3";s:16:"F4";s:10:"F5";}');
>
> it result in
> INSERT IGNORE INTO table (valuel3·Ó%⣟½È?A
> L) VALUES
>
> (\'a:3:{s:12:\"F1\";s:6:\"nombre\";s:11:\"F2\";s:5:\"F3\";s:16:\"F4\";s:10:\"F5\";}\');
>
> and of course it's not a valid SQL sentence.
>
> Why can't I escape an SQL value with " ???
>
> Regards.
>
> I.Lopez.
>
>
Hello,
Actually, the problem is that you're not just escaping the content of the
insert, but the entire insert statement itself. You need to only escape the
data, not the query. To properly prepare your statement, you need something
like this:
$sql = "INSERT IGNORE INTO table (value) VALUES
('".mysql_real_escape_query($my_serialized_string)."');";
Note that the mysql_real_escape_string() function is *not* affecting the
apostrophes (') that delineate the value.
Michiel