Databases
StackOverflow2013
Postsdbo
POmysql_real_escape_string Not Working with '
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POmysql_real_escape_string Not Working with '
    primarykey
    data
    text
    <p>I have a form processed with PHP. It contains a field for Notes about the client job. The problem is that if there is a ' within in the notes - such as it's, O'Reilly, that's etc, it escapes the string in the database, so I have all of the notes up until it encounters the ' then that's the end of the notes.</p> <p>I realise there are things like mysqli_ and PDO, but it's the busy season at the moment and I could just do with quickly fixing this before doing a complete update/overhaul in January.</p> <p>Any idea why it isn't working? Code included. It doesn't matter where I put the mysql_real_escape_string(), it doesn't work anywhere.</p> <p>FYI: The table column is TEXT. And there are a couple of other fields hence the foreach</p> <pre><code>// SELECTS AND CONNECTS TO SERVER/DB include_once('config/db.inc.php'); // CONVERT ALL $_POST['name'] to $name and clean/prep for mysql insertion foreach($_POST as $key =&gt; $value ) { $$key = mysql_real_escape_string($value); } // UPDATE CLIENT JOB NOTES $query = "UPDATE client_list SET bookingNotes='$bookingNotes' WHERE id='$CID'"; mysql_query($query, $conn) or die(mysql_error()); </code></pre> <p>TIA</p> <p><strong>Edit for the responses below:</strong></p> <p>$bookingNotes and $CID are define by the form variables $_POST['bookingNotes'] and $_POST['CID'] where the foreach essentially removes the "_POST" part. (that's the whole $$key = $value part)</p> <p>As mentioned, I appreciate mysqli_ and PDO but am currently unable to learn, update and implement those system wide at the moment. This runs locally and my current version of PHP 5.4.1 supports the function. I understand PDO is better, but for now that is not an option so please don't belittle me with "do it properly" or "learn how to code". That isn't the issue at hand.</p> <p>I know what's happening and where and why - mysql is treating the ' as and end of the string. But I don't know why it's happening when I believe the function should escape the ' and allow it into the database.</p> <p>To surmise, this is what happens.</p> <p>"Today is very grey and it's raining" is entered into the form as $bookingNotes. The script then inputs that into the TEXT column of the database. But what appears in the database is;</p> <p>"Today is very grey and it"</p> <p>TIA and Thanks for the responses so far.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USBiomech
    1. USBiomech
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POmysql_real_escape_string Not Working with '
      1. This table or related slice is empty.
      1. VTDownMod
    2. VO
      singulars
      1. POmysql_real_escape_string Not Working with '
      1. This table or related slice is empty.
      1. VTDownMod
    1. COWhere are $bookingNotes and $CID defined, they seems to not take values from the looped array values
      singulars
      1. POmysql_real_escape_string Not Working with '
      1. USRoyal Bg
    2. COwhich php version are you using? original mysql extension is depreciated from php 5.5.x versions.
      singulars
      1. POmysql_real_escape_string Not Working with '
      1. USNishant
    3. COMaybe this is wrong? --> `$$key`
      singulars
      1. POmysql_real_escape_string Not Working with '
      1. USaldanux
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload