Saving Text to MySQL

[Sims]

Hi

I have a small form where users can comment on some articles on the web
site.
But to prevent abuse I want the form to save the comments and email it to me
to review.

But that means that the user can still abuse the form itself or cause
Query/SQL problems, (with special character for example).

So how would I save ANY text to the database? And if I have to convert the
text how do I retrieve it correctly?

For example if the user enters "This is a quote, 'hello world'" how should I
handle special characters?
Would you advise me to handle all my text fields the same way to prevent
abuse/hacking?

And how should I protect my fields against hacking?

Many thanks
Sims

[Alvaro G Vicario]

Re: Saving Text to MySQL

*** Sims wrote/escribió (Wed, 5 May 2004 11:20:29 +0100):[color=blue]
> So how would I save ANY text to the database?[/color]

Usage: string mysql_escape_st ring ( string unescaped_strin g )

Purpose: Escapes a string for use in a mysql_query.
Availability: PHP 4 >= 4.0.3



--
--
-- Álvaro G. Vicario - Burgos, Spain
--

[Ken Robinson]

Re: Saving Text to MySQL

"Sims" <siminfrance@ho tmail.com> wrote in
news:c7af62$1jp i9$1@ID-162430.news.uni-berlin.de:
[color=blue]
> So how would I save ANY text to the database? And if I have to convert
> the text how do I retrieve it correctly?
>
> For example if the user enters "This is a quote, 'hello world'" how
> should I handle special characters?[/color]

What I have been doing is urlencode(strip slashes($_POST['field'])) for
storing and urldecode($row['field']) for displaying.

Ken Robinson