Home/ Questions/Q 847581
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T06:48:24+00:00

I am writing lots of info from an XML file into a database. Everything

  • 0

I am writing lots of info from an XML file into a database.

Everything works fine until I come across a field with the ' in the description — that insertion fails with an error:

Error

1064:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'd like you to feel that way too. We'd love to have you visit us to view over 100' at line 3

Is there a way to have this inserted without it failing? The import file could be large and change regularly so I cannot search and replace ' characters within it.

My actual PHP Statement is:

$query = mysql_query("REPLACE into list
(id, name, link, description, cost, date_added,type,myipaq,private,imgurl)
VALUES ('$id','$name','$link',"'$description'",'$cost','$date','$type','$myipaq','$private','$imgurl')");
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This falls under the category of SQL injection.

    In PHP a function: mysql_real_escape_string is used to encode a string so that none of it can affect the SQL statement it might be concatenated into.

    so make sure all of your values go through the mysql_real_escape_string function and you will be fine.

    API REF: http://php.net/manual/en/function.mysql-real-escape-string.php

    • 0