Insert a longtext for forum in DB error with: " & '

Question

i'm actually creating a forum from scratch. To insert in my DB the message i use this:

'INSERT INTO forum_sujets VALUES("", "'.$steamprofile['personaname'].'",  "'.$steamprofile['steamid'].'", "'.$_POST['titre'].'", "'.$_POST['message'].'", "'.$date.'", "'.$date.'", "'.$_GET['id'].'", "0" , "0", "0")';

But if I insert a text with a " or a ' it create error. How can i fix this ?

Learn to use parameters! Don't munge query strings with inputs! — Gordon Linoff, Jun 15 '19 at 11:37
Nowadays, to avoid sql injection, use PDO or MySQLi. Use Prepared Statements — hexYeah, Jun 15 '19 at 12:59

score 1 · Accepted Answer · answered Jun 15 '19 at 13:21

You should absolutely avoid directly using raw input in SQL statements as that's a critical security risk for your application. Use prepared statements instead. See How to change from mysql to pdo using prepared statements in PHP? but you can also google, there are many examples online.

As a bonus, this should address any issues you have with spaces and special characters.

I know it may seem like an annoyance but this is a classic and very real security risk, please move to prepared statements.

Insert a longtext for forum in DB error with: " & '

1 Answers1