Question

Alright then I’m having an issue when trying to fill a dropdown with MySQL information. The problem occurs when on the second dropdown I try to get information from things with apostrophes… such as women’s clothing or men’s clothing. Any help with be greatly appreciated.

Here is the error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘s Clothing” at line 1

Here is the code.

<?php
//**************************************
//     Page load dropdown results     //
//**************************************
function getTierOne()
{
    $catresult = mysql_query("SELECT DISTINCT category FROM categories") 
    or die(mysql_error());

      while($tier = mysql_fetch_array( $catresult )) 

        {
           echo '<option value="'.$tier['category'].'">'.$tier['category'].'</option>';
        }

}

//**************************************
//     First selection results     //
//**************************************
if($_GET['func'] == "drop_1" && isset($_GET['func'])) { 
   drop_1($_GET['drop_var']); 
}

function drop_1($drop_var)
{  
    include_once('db.php');
    $result = mysql_query("SELECT DISTINCT level1 FROM categories WHERE category='$drop_var'") 
    or die(mysql_error());

    echo '<select name="drop_2" id="drop_2">
          <option value=" " disabled="disabled" selected="selected">Choose one</option>';

           while($drop_2 = mysql_fetch_array( $result )) 
            {
              echo '<option value="'.$drop_2['level1'].'">'.$drop_2['level1'].'</option>';
            }

    echo '</select>';
    echo "<script type=\"text/javascript\">
$('#wait_2').hide();
    $('#drop_2').change(function(){
      $('#wait_2').show();
      $('#result_2').hide();
      $.get(\"pla2.php\", {
        func: \"drop_2\",
        drop_var: $('#drop_2').val()
      }, function(response){
        $('#result_2').fadeOut();
        setTimeout(\"finishAjax_tier_three('result_2', '\"+escape(response)+\"')\", 400);
      });
        return false;
    });
</script>";
}


//**************************************
//     Second selection results     //
//**************************************
if($_GET['func'] == "drop_2" && isset($_GET['func'])) { 
   drop_2($_GET['drop_var']); 
}

function drop_2($drop_var)
{  
    include_once('db.php');
    $bresult = mysql_query("SELECT DISTINCT level2 FROM categories WHERE level1='$drop_var'") 
    or die(mysql_error());

    echo '<select name="drop_3" id="drop_3">
          <option value=" " disabled="disabled" selected="selected">Choose one</option>';

           while($drop_3 = mysql_fetch_array( $bresult )) 
            {
              echo '<option value="'.$drop_3['level2'].'">'.$drop_3['level2'].'</option>';
            }

    echo '</select> ';
    echo '<input type="submit" name="submit" value="Submit" />';
}
?>

Answer 1

I figured it out. I had to change the

"SELECT DISTINCT level2 FROM categories WHERE level1='$drop_var'"

to

"SELECT DISTINCT level2 FROM categories WHERE level1='".mysql_real_escape_string$drop_var"'"