Question

I have $_POST in form through PHP into a MYSQL DB that have apostrophes like “O’Hara” and then I get slashes. I know that mysql_real_escape_string puts slashes to prevent things like that but how can I check a DB with a string that has apostrophes in it?

Example:

$name = mysql_real_escape_string(stripslashes($_POST['full_name']));
$check = mysql_query("SELECT * FROM `stadiums` WHERE `stadium_name` LIKE '%$name%' LIMIT 0, 10") or die(mysql_error());

Answer 1

Try

$name = $_POST['full_name'];
if (get_magic_quotes_gpc()) {
  $name = stripslashes($name);
}
$name = mysql_real_escape_string($name);
$check = mysql_query("SELECT * FROM `stadiums` 
  WHERE `stadium_name` LIKE '%$name%' LIMIT 0, 10") or die(mysql_error());

Use stripslashes on input only if magic quotes is enabled.