Question

I am attempting to replace ‘ with ” for error reasons within MSSQL queries. I understand that it could be more secure, I am just learning and they will get more secure.

So I used str_replace. and did this.

$dbTABLE = "Table_Name";
$query_sql = sprintf("UPDATE %s SET PageHTML = ('%s') WHERE PageID = '%d'",
$dbTABLE,
str_replace("'","''",$PageHTML),
$PageID);

Worked fine, but for consistency and ease of use I want to write a function I could just include in all pages. Function looks like this:

 function SQLencode($svalue) {

str_replace("'","''",$svalue);

}

and implemented like this:

SQLencode($PageHTML),

However this just wipes all data from the query, I don’t understand why. All my data is just blank afterwards. Can anyone tell me where I am going wrong?

Answer 1

You need to return the value from the function SQLencode(..).

function SQLencode($svalue) {
    return str_replace("'","''",$svalue);
}