Problem with queries format

[Bart]

I got this code:

$addentry = "insert into
ipsheet(ipaddre ss,name,nat,pin gresponse,dnsre solution,locati on,comments,sm, vlan,macaddress )
values
('$_POST[ipaddress]','$POST[name]','$POST[nat]','$_POST[pingresponse]','$_POST[dnsresolution]','$_POST[location]','$_POST[comments]','$_POST[sm]','$_POST[vlan]','$_POST[macaddress]')";
$rs = mysql_query($ad dentry);

if ($rs) echo ("<center><h3>N ew entry added
successully</h3></center>");

$audit = "insert into audit(user,type ,sql) values
('$username','n ewentry','$adde ntry')";
echo $audit;
$rs = mysql_query($au dit);

When I run that code the $audit looks like this:
insert into audit(user,type ,sql) values ('test','newent ry','insert into
ipsheet(ipaddre ss,name,nat,pin gresponse,dnsre solution,locati on,comments,sm, vlan,macaddress )
values ('5.4.4.4','',' ','','test','te st','test','tes t','test','test ')')

but php does not like it so its not being insert into table.

How can I pass whole sql statement and insert it to table?

thx

[Alvaro G. Vicario]

Re: Problem with queries format

*** Bart escribió/wrote (23 Aug 2006 14:19:47 -0700):

$addentry = "insert into
ipsheet(ipaddre ss,name,nat,pin gresponse,dnsre solution,locati on,comments,sm, vlan,macaddress )
values
('$_POST[ipaddress]','$POST[name]','$POST[nat]','$_POST[pingresponse]','$_POST[dnsresolution]','$_POST[location]','$_POST[comments]','$_POST[sm]','$_POST[vlan]','$_POST[macaddress]')";
$rs = mysql_query($ad dentry);

Find some reading about SQL Injection. Wikipedia article is quite
interesting.

Short answers: mysql_escape_st ring()



--
-+ http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
++ Mi sitio sobre programación web: http://bits.demogracia.com
+- Mi web de humor con rayos UVA: http://www.demogracia.com
--

[Bart]

Re: Problem with queries format

Great it works thanks a lot


Alvaro G. Vicario wrote:

*** Bart escribió/wrote (23 Aug 2006 14:19:47 -0700):

$addentry = "insert into
ipsheet(ipaddre ss,name,nat,pin gresponse,dnsre solution,locati on,comments,sm, vlan,macaddress )
values
('$_POST[ipaddress]','$POST[name]','$POST[nat]','$_POST[pingresponse]','$_POST[dnsresolution]','$_POST[location]','$_POST[comments]','$_POST[sm]','$_POST[vlan]','$_POST[macaddress]')";
$rs = mysql_query($ad dentry);

>
Find some reading about SQL Injection. Wikipedia article is quite
interesting.
>
Short answers: mysql_escape_st ring()
>
>
>
--
-+ http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
++ Mi sitio sobre programación web: http://bits.demogracia.com
+- Mi web de humor con rayos UVA: http://www.demogracia.com
--