Databases
StackOverflow2013
Postsdbo
POHow can I escape single quotes in this scenario?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow can I escape single quotes in this scenario?
    primarykey
    data
    text
    <p>I have a page which makes a jquery call to an api to receive multiple wikipedia urls. I then extract the article names from the url (i.e. get <code>science</code> from <code>http://en.wikipedia.org/science</code> etc), add single quotes (') to each one, string them together and finally send them to a php page, which makes a mysql <code>select * from MyTable where title in('name1','name2','name3','name4')</code> call. The problem arises when the article name already has a single quote in it (i.e. "Hick's law"), as it breaks the <code>where in</code> single quotes. Here's the code I'm using:</p> <pre><code>$.getJSON('http://ajax.googleapis.com/ajax/services/search/web?q=keyword site:en.wikipedia.org&amp;rsz=8&amp;v=1.0&amp;callback=?', function (r) { var urls1=""; $.each(r.responseData.results, function(i, item) { var thisurl = (i==0) ? "'" + item.url.substring(item.url.lastIndexOf('/') + 1) + "'" : ",'" + item.url.substring(item.url.lastIndexOf('/') + 1) + "'"; urls1 += thisurl.replace(/_/g,'%20'); });}); $('#quotes').html($('&lt;div&gt;').load('pr.php?s='+urls1 +' #quotes', function() {} </code></pre> <p>I'm adding the single quotes to the article names so the string should be all ready to go for the mysql <code>where in</code>. </p> <p>So to recap, the steps are as follows: </p> <ol> <li>Make an api call and get multiple Wikipedia urls,</li> <li>get the article name from each url,</li> <li>add them to the <code>urls1</code> string while replacing underscores with spaces</li> <li>send the <code>urls1</code> string via ajax to the pr.php page.</li> <li>In pr.php I do the following: <code>"SELECT * FROM MyTable WHERE title in".$_GET['s']</code></li> </ol> <p>I tried doing <code>mysql_real_escape_string($_GET['s'])</code> but that didn't work.</p> <p>I'm now trying to escape any single quotes inside the article names so the <code>where in</code> doesn't break, but it's not working. I tried changing the above to</p> <pre><code>var thisurl=(i==0) ? "'"+item.url.substring(item.url.lastIndexOf('/') + 1).replace(/'/g, "\'")+"'":",'"+item.url.substring(item.url.lastIndexOf('/') + 1).replace(/'/g, "\'")+"'"; </code></pre> <p>But it didn't work. Any ideas?</p> <p>TIA!</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USPhil
    1. USPhil
    plurals
    1. PL
      singulars
      1. LTDuplicate
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow can I escape single quotes in this scenario?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POHow can I escape single quotes in this scenario?
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POHow can I escape single quotes in this scenario?
      1. This table or related slice is empty.
      1. VTDownMod
    1. CO[The Great Escapism (Or: What You Need To Know To Work With Text Within Text)](http://kunststube.net/escapism/)
      singulars
      1. POHow can I escape single quotes in this scenario?
      1. USdeceze
    2. COwhy are you trying to escape using JS? you should escape in PHP
      singulars
      1. POHow can I escape single quotes in this scenario?
      1. USJamesHalsall
    3. COYou are passing half the SQL statement via an URL? that sounds terrible, error prone and just plain wrong. Send json back to PHP, use json_encode/json_decode, and handle escaping server side (e.g. by using parametrized queries)
      singulars
      1. POHow can I escape single quotes in this scenario?
      1. USMahn
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload