note 34447 added to function.mysql-query

> mysql does not understand single quotes (') or backslashes > (\) in queries, so if you need to add something containing > these signs to a mysql database, use urlencode : First of all, this is probably quite novice, and not something that many people would have the need to do... I just ran into something similar, but it's different enough to warrant a seperate post here. If you're using an HTML form to accept and execute a SQL statement that contains singe or double quotes, the field will come through with backslashes in front of those characters. For example, an HTML text form field containing: -------------------------------------------------------------- insert into foo_table (first,last) values ("bob","smith"); -------------------------------------------------------------- is received from the form as: -------------------------------------------------------------- insert into foo_table (first,last) values (\"bob\",\"smith\"); -------------------------------------------------------------- The statement is determined to be invalid when used with the mysql_query function. It's because of the backslashes. Take them out using a preg_replace statement, and all will be well. Here's what I used: ------------------------------------------------- $sql_query = preg_replace("/\\\/","",$sql_query); mysql_query($sql_query,$cid); ------------------------------------------------- ---- Manual Page -- http://www.php.net/manual/en/function.mysql-query.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+34447 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+34447&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+34447&report=yes