[zitwep]

Hey,

I am having the following problem.

I have variables saved which might include apostrophes, and insert them into my database this way: "INSERT INTO members (name) ('" . $var . "');";

now that would not work when somebody used an apostrophe in the news (in my case it is a news posting script, and $var is the news).

How would i prevent that from happening, i do not know another way to insert into database, i hope there is an easy way. If not could you explain me? I thought about perhaps you have to search the variable for apostrophes and put a \ in front but dont even ask how to do that.

Anyway hoping for your support, and thanks a lot in advance as usual

best regards
max

[mab]

Depending on the magic quotes setting, data that comes from a form/post normally has the single and double quotes escaped (along with nulls and backslashes). It would appear that this setting is off on your server.

To escape these in your data before inserting it into your database, use the PHP addslashes function - http://www.php.net/manual/en/function.addslashes.php

[Keith]

It is actually safer and generally better recommended to use mysql_real_escape_string() as opposed to addslashes(), though 99% of the time addslashes() is sufficient.