" mess up my INSERT into query

[Swedie]

Hey

I'm doing a little chat script and when I submit a post that includes the character ' it totally mess up the Query script.

In what way I can bypass that problem? I need to be able to use odd characters like that.

Thanks in advance.

[GameCrash]

Try this:

$message = addslashes($message); 

[Icheb]

addslashes(htmlspecialchars($variable)) would be safer actually.

[Chen]

Actually you shouldn't htmlspecialchars() it when placing in the database, only in runtime when the data is displayed. That way you don't lose its original state...

[Swedie]

Actually you shouldn't htmlspecialchars() it when placing in the database, only in runtime when the data is displayed. That way you don't lose its original state...

Ok, so how do I submit something into the database that includes ' ... ?

the post is through a <form> and goes to a new page, post.php. Where a query inserts it to the database like this:

mysql_query("INSERT INTO message VALUES ('', $message, '$bbuserinfo[username]', '$bbuserinfo[userid]', '$posttime', '$category', '$color');") or die("MySQL Query Failed: " . mysql_error());

I'd like help.

[XTJ7]

actually i prefer something like

mysql_query( "INSERT INTO `messages` VALUES ( '', '" . addslashes( $message ) . "', '" . addslashes( $bbuserinfo[ 'username' ] ) . "', '" . addslashes( $posttime ) . "', '" . addslashes( $category ) . "', '" . addslashes( $color ) . "' );" ) or die("MySQL Query Failed: " . mysql_error() );

is much safer, but i recommend to give mysql the fields with the table so that you just insert the fields you had been selected.
like

INSERT INTO `messages` (`name`, `info`, `others`) VALUES ( 'xtj7', 'programmer', 'foo' );

so you can leave out id and it increments automatically without giving mysql an empty field.

c:ya

[Swedie]

what's wrong in this query?

mysql_query("INSERT INTO message ('message', 'postername', 'posterid', 'category', 'color') VALUES ( '" . addslashes( $message ) . "', '" . addslashes( $bbuserinfo[username] ) . "', '" . addslashes( $bbuserinfo[userid] ) . "', '" . addslashes( $category ) . "', '" . addslashes( $color ) . "');") or die("MySQL Query Failed: " . mysql_error());


I get:
MySQL Query Failed: You have an error in your SQL syntax near ''message', 'postername', 'posterid', 'category', 'color') VALUES ( 'sadsda', 'Wh' at line 1

[Chen]

Field names should be quoted with single quotes - either use backstick (`) or don't quote them at all.

[Swedie]

figured it out...

chen

what is a backstick.. never heard about it and .. hence not knowing why that should be used.. ever.. care to let me know?

[Chen]

It's just the name of this character: `

[Swedie]

but when is that backstick supposed to be used?

[Icheb]

You use

INSERT INTO message ('message', 'postername', 'posterid', 'category', 'color')

You should use

INSERT INTO message (`message`, `postername`, `posterid`, `category`, `color`)

Or just don't use them at all.

[GameCrash]

It's allways used if you use a reserved keyword as a table or column name for example...