1

I have a local MySQL database with a few tables, each with a few entries. I wanted to export this table so I could import it into my live website's MySQL database. I did so without any errors regarding data entry; all of the tables and their values were successfully exported from my local database and imported into the live one.

I have one PHP file per table that retrieves the table's data. On my local server, each file successfully retrieves its respective table's data. When transferred to the live server, each file works except for one. This one file doesn't receive the database rows. The PHP file gives no error message. When I delete every row from this table and manually insert a row, it returns this row some of the time.

I eventually found the issue — that the problematic column has double quotations around every entry.

This is the structure of the database. The column quote seems to be the problematic one as removing the quotes from the entries gets it working again:

CREATE TABLE quotes (
    id int(11) AUTO_INCREMENT PRIMARY KEY NOT NULL,
    quote TEXT NOT NULL, //I believe this is the problematic column
    created DATETIME NOT NULL,
    character_id int(11) NOT NULL,
    word TEXT NOT NULL,
    approved TINYINT(1) NOT NULL,
    source TEXT NULL,
    FOREIGN KEY (character_id) REFERENCES characters (id) ON DELETE CASCADE ON UPDATE CASCADE
) ENGINE=InnoDB;

Here's an example of the SQL I used to insert the rows:

INSERT INTO quotes (quote, created, character_id, word, approved, source) VALUES ('“Oh, speaking of a giant flying bird, there\'s one right there!”', NOW(), 1, "bird", 1, "Super Monkey Ball Gameplay")

This row is an example that doesn't return to the PHP file on my live site because I used the single quotes in the quote column value and then double quotes inside it. To be clear, the entry works fine — it shows up the in the database as the given text surrounded by double quotes. The select query is what's problematic. When I run the select query in MySQL, both on my local server and on my live one, it works fine, but the same query doesn't work in the PHP file on the live server. On my local database, retrieving this data with the PHP file is not an issue, but on my live server, it is.

So, on my live server, I deleted every entry and inserted a row like this, which doesn't contain double quotes, which worked:

INSERT INTO quotes (quote, created, character_id, word, approved, source) VALUES ('Hi', NOW(), 1, "Hi", 1, "Super Monkey Ball Gameplay")

Notice how the value of the quote column has single quotes and doesn't have double quotes inside of it. This works with the select statement in the PHP file on the live server.

This is the PHP file code:

<?php

include 'dbh.inc.php'; //database connection

if ($_SERVER['REQUEST_METHOD'] == 'GET') {

$q = "SELECT * FROM quotes WHERE character_id = ? AND approved = 1"; //Problematic SQL statement
$stmt = mysqli_prepare($conn, $q);
mysqli_stmt_bind_param($stmt, 'i', $characterId);

$characterId = $_GET['characterId'];

mysqli_stmt_execute($stmt);

$r = mysqli_stmt_get_result($stmt);

if (mysqli_num_rows($r) != 0) {

    while ($row = mysqli_fetch_array($r)) {

        $data['quoteId'] = $row['id'];
        $data['quote'] = $row['quote'];
        $data['character_id'] = $row['character_id'];
        $data['word'] = $row['word'];
        $data['approved'] = $row['approved'];
        $data['source'] = $row['source'];
        $results[] = $data;

    }

    echo json_encode($results);

} else {

    echo mysqli_stmt_error($stmt);

}

}

Question

Why are my rows returning when requested in the PHP file on my local server, but not on my live one, because of the fact that the double quotes are surrounded by single quotes? Is there a setting I need to change in the live database? Let me know if anything else is needed.

Things I've Tried / Notes

  • My table's sql_mode is not set to strict. Running SHOW VARIABLES LIKE 'sql_mode' shows an empty result. I also can't change the values because when I run set global sql_mode='', I get the error #1227 - Access denied; you need (at least one of) the SUPER privilege(s) for this operation
Carson D
  • 81
  • 13
  • Does this answer your question? [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – CBroe Aug 16 '22 at 06:25
  • @CBroe I don't believe so. Were you thinking of a certain aspect of the question? – Carson D Aug 16 '22 at 06:39
  • Sorry, what exactly is the issue with the quotes supposed to be then? Once you got your data into your database, I don't see how they should make any difference when it comes to reading the data back. Are you getting any errors, or just not the expected amount of records back? – CBroe Aug 16 '22 at 06:47
  • @CBroe That's what I'm not understanding. I'm not getting anything — the file returns nothing at all. No errors. When I remove the "quote" column from what I want to fetch after executing the query, the data returns normally again. So I'm almost certain it's the fact that there are quotes in these columns, but I'm not sure why it's an issue. I'm not super knowledgeable when it comes to databases, so I'm wondering if there's a default database setting, like something related to having a "strict" table, that's causing the issue. – Carson D Aug 16 '22 at 07:00
  • Do you have proper PHP error reporting enabled? Do you have your database connection set to "report" errors, by throwing exceptions? If not, go do both those things. Go check what the error log has to say after. – CBroe Aug 16 '22 at 07:09
  • @CBroe Yeah, all of those are set. The error log doesn't say anything, either. However, after echoing ```$data['quote']``` in the PHP file, I found that the quotation marks are coming back as black question marks - maybe an encoding issue? – Carson D Aug 16 '22 at 07:49
  • 2
    Yes, go check https://stackoverflow.com/q/279170/1427878 – CBroe Aug 16 '22 at 07:51
  • @CBroe Yes, adding ```$conn -> set_charset("utf8mb4");``` to my database connection file worked. Thanks a ton. – Carson D Aug 16 '22 at 08:05

0 Answers0