insert single quote before inserting

Question

My php code returns some value, I am trying to insert in database.

$string =  '1,here,Skincare composition against free radicals'; //this is returned

'(insert into import (S.No,Name,Title)) values ($string)'

Need to convert that string in proper format to insert in db

'1','here','Skincare composition against free radicals'  //This is expected

implode should do it? But I dont know how?

That should work, since your SQL is a string... – christopher Dec 07 '12 at 05:10 — christopher, Dec 07 '12 at 05:10
@christopher But you need `'`s, right? – irrelephant Dec 07 '12 at 05:10 — irrelephant, Dec 07 '12 at 05:10
@irrelephant Ah duh. Kuya's answer is good – christopher Dec 07 '12 at 05:12 — christopher, Dec 07 '12 at 05:12

score 10 · Accepted Answer · edited May 23 '17 at 12:21

10

try,

$string =  "1,here,Skincare composition against free radicals";
$varList = explode(",", $string);
$newQuery = "INSERT INTO `import` (`S.No`,`Name`,`Title`) VALUES ('" . $varList[0] . "','" . $varList[1] . "','" . $varList[2] . "')";

but the query is vulnerable with SQL Injection, please read the article below to how learn to protect from it,

How to prevent SQL injection in PHP?

Other Source

PHP Explode

edited May 23 '17 at 12:21

Community

1
1

answered Dec 07 '12 at 05:10

John Woo

258,903
69
498
492

or even better, use prepared statement to prevent SQL Injection – Raptor Dec 07 '12 at 05:11
1

@ShivanRaptor yep, that's why I added link on how to protect using prepared statement `:D` – John Woo Dec 07 '12 at 05:12

insert single quote before inserting

1 Answers1