'(single quote) & "(double quote) insert & extract in mysql

Discussion in 'MySQL' started by Ankit, Oct 14, 2007.

0
  1. #1
    What is the best way to handle '(single quote) & "(double quote) insert & extract in mysql with php
     
    Ankit, Oct 14, 2007 IP
  2. Lordy

    Lordy Peon

    Messages:
    1,643
    Likes Received:
    29
    Best Answers:
    0
    Trophy Points:
    0
    #2
    well, i just learned in here from TwistMyArm

    a good way to insert it would be with mysql_real_escape_string
    i think extracting it should be fine, don't quote me on it :eek:
     
    Lordy, Oct 14, 2007 IP
  3. upl8t

    upl8t Peon

    Messages:
    80
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #3
    When inserting quotes into mysql you need to quote them first. The easiest way is to use a function like mysql_real_escape_string as Lordy suggested. Another thing you can use is a sanitization library like the built in filter functions in PHP5, or the sanitization library from OWASP. These libraries are much better then just pure quoting, since it handles alot of other security issues.

    For information on the built in PHP Filter library see:

    http://www.php.net/manual/en/ref.filter.php

    And

    http://phpro.org/tutorials/Filtering-Data-with-PHP.html

    For information on the OWASP Library see the tutorial here:

    http://www.phpbuilder.com/columns/ryan_mcgeehan20060627.php3


    As far as extraction goes, once the data is inserted, it is in the normal unquoted format. So once you pull it, it's fine. Though depending on the circumstances you may also want to use something like html_special_chars on certain data (especially user insert data) just in case. This will change things like < > and quotes into their html equivalent.
     
    upl8t, Oct 22, 2007 IP