note 34447 deleted from function.mysql-query by didou

Note Submitter: Clint Sulis ---- > mysql does not understand single quotes (') or backslashes > (\) in queries, so if you need to add something containing > these signs to a mysql database, use urlencode : First of all, this is probably quite novice, and not something that many people would have the need to do... I just ran into something similar, but it's different enough to warrant a seperate post here. If you're using an HTML form to accept and execute a SQL statement that contains singe or double quotes, the field will come through with backslashes in front of those characters. For example, an HTML text form field containing: -------------------------------------------------------------- insert into foo_table (first,last) values ("bob","smith"); -------------------------------------------------------------- is received from the form as: -------------------------------------------------------------- insert into foo_table (first,last) values (\"bob\",\"smith\"); -------------------------------------------------------------- The statement is determined to be invalid when used with the mysql_query function. It's because of the backslashes. Take them out using a preg_replace statement, and all will be well. Here's what I used: ------------------------------------------------- $sql_query = preg_replace("/\\\/","",$sql_query); mysql_query($sql_query,$cid); -------------------------------------------------