Problem in inserting record in mysql using php

Hello experts

My code is working well when I dont have quote in the text but when I have a quote its not allowing to insert in mysql table.

What should i do?

 

Use mysqli_real_escape_string function to escape the string. You should do so to avoid any security hole. For example

<?php
<?php
$dbC = mysqli_connect('localhost', 'user', 'pass', 'database');
$data1 = mysqli_real_escape_string($dbC, $_POST['data1']);
$data2 = mysqli_real_escape_string($dbC, $_POST['data2']);
mysqli_query($dbC, "INSERT INTO table_name(field1, field2) VALUES({$data1}, {$data2})");
?>

PHP:

Hope it helps.

 

or just mysql_real_escape_string if you dont have mysqli module installed

 

yes, you have to escape the special characters before inserting to mysql. mysql_real_escape_string() will defiitely help!