1

Hey So I think my question is fairly easy but I just can't seem to find the right way to fix it.

I have a form the user is suppose to fill that its then inserted to a database and it can be retrieved later on, and it was working fine until when testing I used quotes...when using quotes(single or double) the strings closes and it's only inserted the first part of the string.

For example if he writes "Jeff's house", the only things I get is "Jeff\"

what gives?

  • 2
    It means that you should be looking at moving to using prepared statements and bound variables as soon as possible. – andrewsi Jun 05 '13 at 15:05
  • [The Great Escapism (Or: What You Need To Know To Work With Text Within Text)](http://kunststube.net/escapism/) – deceze Jun 05 '13 at 15:05
  • Have a read on sql injection and application security in general – user466764 Jun 05 '13 at 15:11
  • 1
    See [How to escape strings in SQL Server using PHP?](http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php) and (more importantly) [How to prevent SQL injection in PHP?](http://stackoverflow.com/questions/574805/how-to-escape-strings-in-sql-server-using-php) – Richard JP Le Guen Jun 05 '13 at 15:12

2 Answers2

0

The issue you have is that users can affect your database using MySQL injection.

Have a read on PDO Prepared statements to avoid users being able to use single/double quotes to their advantage to break the string and send commands directly to your SQL database, compromising your data.

It works by separating the string from the SQL statement so that it is not part of the instruction to the database.

(Using this system will also mean that your database will be able to store the entire string, regardless of quotation marks - but they will have a slash (\) before each one when stored. These can be removed when displaying the data using the stripslashes command.)

Ben
  • 8,894
  • 7
  • 44
  • 80
0

Use mysql_escape_string() function to filter you string before use it in the INSERT query.

for more help see this link http://php.net/manual/en/function.mysql-escape-string.php

Amar Banerjee
  • 4,992
  • 5
  • 34
  • 51