-1

I want to pass sValue that contain non-English String 

  ....
 $.post("ajax.php?module=test&action=updates&id="+id+"&field="+field+"&val="+sValue;                                    
...

Then

$valUpdate = $_GET['val'];
$sQuery = " UPDATE $sTable SET  $colUpdate = '$valUpdate' WHERE  id = $id";
    $req = $pdo->prepare($sQuery);
    $req->execute();
    $req->closeCursor();

Anyone could told me ,How can I fix this ?

thanks

hakre
  • 193,403
  • 52
  • 435
  • 836
sophie
  • 1,523
  • 6
  • 18
  • 31
  • maybe this will help you: http://stackoverflow.com/questions/834316/how-to-convert-large-utf-8-strings-into-ascii – Cristi Pufu Jun 19 '12 at 22:18
  • You're using `$.post` with GET parameters. Just have to set POST parameters instead. – sp00m Jun 19 '12 at 22:49
  • Technically he's passing them as GET parameters, on account of the ?...& – jcolebrand Jun 20 '12 at 02:04
  • What's the point of using prepared statements if you do `$sQuery = " UPDATE $sTable SET $colUpdate = '$valUpdate' WHERE id = $id";`? With `$valUpdate` being user input. – laurent Jun 20 '12 at 03:48

1 Answers1

1

You should use encodeURIComponent(sValue).

Also consider using some kind of SQL-injection free syntax like prepared statements.

mroesler
  • 98
  • 6