apostrophe generating SQL error

Question

I created a form to collect user data, including address and write them in a Mysql DB. In the user table, Street is a Varchar (255). Everything works fine, unless in the name street there's an apostrophe, in this case I have the following SQL warning:

For example, if in the Street name I put "Francesco D'assisi 24"

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'assisi 24',

Any idea how to avoid it?

It`s called sql injection use prepared statements.http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — Mihai, Feb 15 '14 at 18:23

score 0 · Answer 1 · answered Feb 15 '14 at 18:21

0

Pass the variables via a stored procedure parameters.

answered Feb 15 '14 at 18:21

user3241191

505
2
5
12

score 0 · Answer 2 · answered Feb 15 '14 at 18:52

Need to escape data: use function mysql_real_escape_string (or analogs in other libraries), or using PDO and parameters.

For example:

$data = <<<TXT
Francesco D'assisi 24
TXT;

$data = mysql_real_escape_string($data);
mysql_query("INSET INTO table VALUES ('$data')") or die mysql_error();

apostrophe generating SQL error

2 Answers2