PHP Error Character (HELP!)

**dlite922** · Feb 14 '08, 04:58 AM

Originally posted by werks

Hello PHP experts how can you detect ' character in your search field?
Because every time I input the word hilgard's it returns an error I think because of the character '. This is the error

[CODE=php]
Warning: odbc_exec() [function.odbc-exec]: SQL error: [Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'Title LIKE '%hilgard's%';' ., SQL state 37000 in SQLExecDirect in D:\wamp\www\Onl ine Library\opac.ph p on line 76
[Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'Title LIKE '%hilgard's%';' .
[/CODE]

tnx in advance.

--
Kenneth
"Better Than Yesterday"

Its about time you know about a little some'n some'n called

SQL INJECTION

http://www.google.com/search?hl=en&q=SQL+Injection

After you studied it, then do learn how to prevent it:

PHP: mysql_real_escape_string - Manual

http://us3.php.net/manual/en/function.mysql-real-escape-string.php

Escapes special characters in a string for use in an SQL statement

Only you have MS SQL and not MySQL, but you get the point.

If you're still not satisfied.

Just use string replace

PHP: str_replace - Manual

http://us3.php.net/manual/en/function.str-replace.php

Replace all occurrences of the search string with the replacement string

[PHP]

str_replace("'" , "\'", $sqlString);