Php Mysql Form Problem

Discussion in 'Databases' started by Vincentas, Jan 21, 2013.

  1. #1
    Hi guys,

    I have a form set up to insert data into a table in MySQL database. In the text field, everything inserts to the table just fine as long as the user doesn't enter a contraction into the test field (It's, I've, etc.). If the user does enter a contraction into their response, none of the information from the form makes it to the database table.

    Anyone know what's going on here?
     
    Vincentas, Jan 21, 2013 IP
  2. w3coding

    w3coding Active Member

    Messages:
    151
    Likes Received:
    3
    Best Answers:
    0
    Trophy Points:
    80
    #2
    Can you please post your code here and I'll try to help.
     
    w3coding, Jan 22, 2013 IP
  3. Rukbat

    Rukbat Well-Known Member

    Messages:
    2,908
    Likes Received:
    37
    Best Answers:
    51
    Trophy Points:
    125
    #3
    If the user enters an apostrophe, that ends the data for the field. You have to clean the user-entered data before inserting it. (What you're doing leaves you open to a SQL Injection attack.)

    Either use str_replace() to replace ' with '' (2 single quotes), or use mysqli_real_escape_string() to clean the string up.
     
    Rukbat, Jan 22, 2013 IP