/    Sign up×
Community /Pin to ProfileBookmark

Query works except when variable has apostrophe in it

Hello,

The query below works if $find is just a regular word with no special characters, and it even works if $find has a “%” in it or a “&”.

However, it does not work if $find has an apostrophe in it. Any ideas on how I can change the code to make it work if $find has an apostrophe in it?

Thanks in advance,

John

[CODE]<?

$find1 = urlencode($find);
print “<form action=’process.php?find=$find1′ method=’post’>
Add site: <input name=’site’ type=’text’ size=’50’>
<input type=’submit’ value=’Submit’>
</form> “;
?>[/CODE]

Then, on process.php, I have:

[CODE]<?

$remove_array = array(‘http://www.’, ‘http://’, ‘www.’);
$site = str_replace($remove_array, “”, $_POST[‘site’]);
mysql_connect(“mysqlv10”, “username”, “password”) or die(mysql_error());
mysql_select_db(“database”) or die(mysql_error());

$_GET[‘find’] = $find;
$_GET[‘find’] = stripslashes($_GET[‘find’]);
$find = urldecode($find);

mysql_query(“INSERT INTO `$find` VALUES (NULL, ‘$site’,1,0)”);

?>[/CODE]

to post a comment
PHP

5 Comments(s)

Copy linkTweet thisAlerts:
@jacjil2Jun 10.2009 — Try mysql_real_escape_string()
Copy linkTweet thisAlerts:
@ArizonaJohnauthorJun 10.2009 — Yeah, I tried that and it didn't make a difference.
Copy linkTweet thisAlerts:
@jacjil2Jun 10.2009 — Yeah, I tried that and it didn't make a difference.[/QUOTE]

Before or after the stripslashes enigma?
Copy linkTweet thisAlerts:
@ShortsJun 10.2009 — [code=php]
mysql_query("INSERT INTO ".mysql_real_escape_string($find)." VALUES (NULL, '".mysql_real_escape_string($site)."',1,0)");
[/code]


Also, you should always have mysql_real_escape_string or equivalent going when running Queries from outside sources (in this case, $_POST['site']) as a defense against SQL Injection. If the input has to be a number personally wrap it in an intval().

http://unixwiz.net/techtips/sql-injection.html
×

Success!

Help @ArizonaJohn spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.17,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,

tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,
)...