-2

I'm trying to insert a string into the database , but when it contains single quote('), the query becomes invalid. 

$set_content=$_POST['content']; 

$result = pg_query($db,"INSERT INTO programmes(title,picture,content) VALUES('$set_title','$pic_path','$set_content');");
Vao Tsun
  • 47,234
  • 13
  • 100
  • 132
Rasik Mohammed
  • 3
  • 2
  • Instead of making yourself vulnerable to SQL Injection, use prepared statements and you won't have this problem: http://php.net/manual/en/function.pg-prepare.php – Jeremy Harris May 25 '17 at 13:10
  • you can't use PHP variable inside single quote. try with below query $set_content=$_POST['content']; $result = pg_query($db,"INSERT INTO programmes(title,picture,content) VALUES('".$set_title."','".$pic_path."','".$set_content."');"); – Gyaneshwar Pardhi May 25 '17 at 13:14

1 Answers1

-1

http://php.net/manual/en/function.pg-query.php

Warning

String interpolation of user-supplied data is extremely dangerous and is likely to lead to SQL injection vulnerabilities. In most cases pg_query_params() should be preferred, passing user-supplied values as parameters rather than substituting them into the query string.

$result = pg_query_params($db,"INSERT INTO programmes(title,picture,content) VALUES($1,$2,$3);",Array($set_title,$pic_path,$set_content));
Vao Tsun
  • 47,234
  • 13
  • 100
  • 132