0

I am getting this code L&#39 in the title of my mysql database. I can't figure out what I am doing wrong. I have tried several lines as you can see below but none seem to work.

The info is being abstracted from a website and placed in a database. However, all kinds of strange characters are being added as well as L&#39. How can I remove this and any other strange characters such as other encoding that does not belong?

I need the vars $t and $content to be safe to put into mysqli.

Here is a part of the code that would matter. 

$con=mysqli_connect("myserver","yadayda","yadayda","yadayda");
// Check connection
if (mysqli_connect_errno()) {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

if (!$con->set_charset("utf8")) {
    printf("Error loading character set utf8: %s\n", $con->error);
} else {
    printf("Current character set: %s\n", $con->character_set_name());
}

for($i = 0; $i < 7; $i++)
{
$ID = date(U);


$t = $Title[$i];


$t = html_entity_decode(htmlentities($t,ENT_QUOTES),ENT_QUOTES);
//$content = htmlentities($content,ENT_QUOTES);


$result = mysqli_query($con,"SELECT * FROM myDatabase WHERE Title ='$t'");
$rowCount = mysqli_num_rows($result);
echo $rowCount;

if($rowCount == 0)
    {


         $content = mysqli_real_escape_string($con,$content); 
    $t = mysqli_real_escape_string($con,$t); 
    mysqli_query($con,"INSERT INTO myDatabase (ID, Content, Title,imageLink,theLink) VALUES ('$ID', '$content','$t','$imageLink','$theLink')");
    }
}
Your Common Sense
  • 156,878
  • 40
  • 214
  • 345
Papa De Beau
  • 3,744
  • 18
  • 79
  • 137
  • 1
    Why are you using `html_entity_decode(htmlentities(...))`? Also, you have a gaping [SQL injection](http://bobby-tables.com) vulnerability. Please use prepared statements instead. – Amal Murali Apr 28 '14 at 08:08
  • I am not sure why. I was just trying to fix it. Don't know too much about the sql injection. looking into it now. – Papa De Beau Apr 28 '14 at 08:10
  • `'` is an HTML-encoded `'`; you should look at using prepared statements so that you don't need to worry about escaping the string yourself. – cmbuckley Apr 28 '14 at 08:19
  • What are prepared statements and can I use them if I am taking the info from a website? – Papa De Beau Apr 28 '14 at 08:21
  • 1
    Here's a question on prepared statements: http://stackoverflow.com/questions/9629328/how-to-use-mysqli-prepared-statements-in-php – cmbuckley Apr 28 '14 at 08:25

0 Answers0