My table has values with quotes and other unescaped characters, and when I
$sometitle = "Ra's al Ghul";
SELECT * from mytable WHERE title='{$sometitle}'
ofc I got an error.
How can I solve this issue?
Asked
Active
Viewed 13 times
0
WebArtisan
- 3,996
- 10
- 42
- 62
-
*"I got an error"* - Being what`, error near 's`? and which api is used to connect with? – Funk Forty Niner Jun 14 '17 at 14:24
-
you also posted pseudo code; what you have now is invalid/incomplete. – Funk Forty Niner Jun 14 '17 at 14:25
-
2Use prepared statements ([PDO](https://secure.php.net/manual/en/pdo.prepared-statements.php) or [mysqli](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) docs). You'll never have to worry about escaping quotes again. – aynber Jun 14 '17 at 14:25
-
smells like injection to *moi* https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 being a possible dupe I feel. – Funk Forty Niner Jun 14 '17 at 14:26
-
Yes, `prepare` is solution – WebArtisan Jun 14 '17 at 14:28