How to handle apostrophs and semicolons

[Stefan Mueller]

I've a web page with several input boxes. After the user clicks 'submit' I
insert these data into my MySQL database.
This worked for several months perfect. But today a user entered the street
name
Route d'Yverdon 59

unfortunately the data has not been inserted into my MySQL database because
of the apostroph (') in the name of the street.

I've no idea how to deal with this problem.
Is there any possibility to avoid that my PHP & Java scripts don't interpret
apostrophs (') and semicolons (")?

Stefan

[Steve Chapel]

Re: How to handle apostrophs and semicolons

Stefan Mueller wrote:[color=blue]
> I've a web page with several input boxes. After the user clicks 'submit' I
> insert these data into my MySQL database.
> This worked for several months perfect. But today a user entered the street
> name
> Route d'Yverdon 59
>
> unfortunately the data has not been inserted into my MySQL database because
> of the apostroph (') in the name of the street.
>
> I've no idea how to deal with this problem.
> Is there any possibility to avoid that my PHP & Java scripts don't interpret
> apostrophs (') and semicolons (")?[/color]

I use PEAR DB with placeholders:

$db->query("inser t into users values (?, ?);", array($name, $address));

will always quote the name and address properly. This not only helps to
put the data in the database properly, but also prevents nasty SQL
injection security attacks. JDBC also can use placeholders for SQL
statements.

[Jerry Stuckle]

Re: How to handle apostrophs and semicolons

Stefan Mueller wrote:[color=blue]
> I've a web page with several input boxes. After the user clicks 'submit' I
> insert these data into my MySQL database.
> This worked for several months perfect. But today a user entered the street
> name
> Route d'Yverdon 59
>
> unfortunately the data has not been inserted into my MySQL database because
> of the apostroph (') in the name of the street.
>
> I've no idea how to deal with this problem.
> Is there any possibility to avoid that my PHP & Java scripts don't interpret
> apostrophs (') and semicolons (")?
>
> Stefan
>
>[/color]

See mysql_real_esca pe_string(). Exists just for this purpose.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[fiziwig]

Re: How to handle apostrophs and semicolons

I had the same problem with putting author names in a MySQL database
when I got the name O'Henry. I found this in Ullman's book "PHP and
MySQL": It fixed my problem right up. BTW: This is my first MySQL
project so I'm just a beginner. Take my advice with a large grain of
salt. That said, it does work.

In main code
....
$dbc = mysql_connect( ...etc...);
....
$questionable_d ata=$_POST['some_form_data '];
$good_data = escape_data( $questionable_d ata );
....

....defined elsewhere...
function escape_data ($data) {
// address Magic Quotes
if (ini_get('magic _quotes_gpc')) {
$data = stripslashes($d ata);
}
// Check for mysql_real_esca pe_string() support
if (function_exist s('mysql_real_e scape_string')) {
global $dbc;
$data = mysql_real_esca pe_string(trim( $data), $dbc);
} else {
$data = mysql_escape_st ring(trim($data ));
}
return $data
} // end escape_data function

--gary shannon