0

hii have php code code to insert text with image into my sql database so the problem is when i insert text that have ' symbol it doesn't insert then when i insert text without ' symbol it works fine this is my code how can i fix the problem

<?php
session_start();
if ((isset($_SESSION['admin'])))
 {
 require_once("../dbconfig.php");

?>

<form method="post" name="data_table" enctype="multipart/form-data">

<?php
error_reporting(0);
if(isset($_POST['add2'])){
include_once '../dbconfig.php';
$username=$_SESSION["admin"];
$subject=$_POST['subject'];
$description=$_POST['description'];
$image = rand(1000,100000)."-".$_FILES['image']['name'];
if(!isset($image))
   echo"Please Upload Image"; 
else{ 
$file_loc = $_FILES['image']['tmp_name'];
$file_size = $_FILES['image']['size'];
$file_type = $_FILES['image']['type'];
$folder="uploads-about/";
$new_size = $file_size/1024;  
$new_file_name = strtolower($image);
$final_image=str_replace(' ','-',$new_file_name);
if(move_uploaded_file($file_loc,$folder.$final_image))
    {
$sql="INSERT INTO about (subject,description,image) 
VALUES ('$subject','$description','$final_image')"; 
$result=mysql_query($sql);
   if($result)
   {
echo "<font size='5px'><div align='center'>Successful</div></font>";
}else
{
echo "<font size='5px'><div align='center'>errror</div></font>";

}      }
else{
echo "<font size='5px'><div align='center'>Select image to upload</div></font>";
}
}
 mysql_close();
}
  ?>
<div align="center">
<br>
        <label for="Username">Subject: </label>&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp
        <input type="text" name="subject" id="Username" style="width:500px;height:40px" />
        <br><br>
        <label for="Password">Description: </label>&nbsp&nbsp
        <textarea name="description" id="Password" style="width:500px;height:100px" ></textarea>
        <br><br>

        <label for="image">Select Image</label>
        <input type="file" class="button purple image" name="image" accept="image/*" id="username" capture  />
        <br><br><br>
        <button name="add2" value="log in" class="button purple add"><span>ADD</span></button>
        </div> 
  </form>
<?php } ?>
mh9
  • 45
  • 1
  • 9
  • 2
    The quick fix to your problem is to escape single quotes in the string, e.g. `''`. But you should really use prepared statements, which would handle this (and many other pitfalls) for you automatically. – Tim Biegeleisen May 01 '17 at 08:06

1 Answers1

1

The PHP addslashes will help but you should sanitize data using :

PPS : Prepared Parameterized Statements. This will help Preventing SQL injection

Also, it will handle this for you, making all stuff more secure, and code more readable :)

EDIT: don't want to vampirize, as it also was stated in comments by @TimBiegeleisen...

Community
  • 1
  • 1
OldPadawan
  • 1,247
  • 3
  • 16
  • 25