I have a form, that when you select a drop down of articles, the textbox is filled in with what you selected. Now it’s working perfectly fine, except for when there’s a ‘single quote’ in the article name.
I have a function for escaping the quotes by placing backslashes in front of them, which it does…
Now the Query produced is as follows:_
SELECT * FROM blogs WHERE title='MySQL \'Inject' AND series='iOS Game Dev.' AND language='iOS' LIMIT 1
And I have a function which makes an object of the article and sets values of everything according to the row selected. When I display the array made by the function which runs the query it gives this..
Blog Object
(
[id] =>
[title] =>
[publish_date] =>
[author] =>
[language] =>
[series] =>
[likes] =>
[content] =>
[position] =>
[status] =>
[last_updated] =>
)
It works if there isn’t a single quote in the article name, but it doesn’t fill the textbox because the array is empty.
More over the value stored in the database for the title is MySQL \’Inject . So I really don’t get why it’s doning this, I even tried run the query in MySQL Workbench and it returned nothing. So it’s not a problem in my code I’m pretty sure.
I’d suggest you save yourself all the pain of worrying about escaping and just use prepared statements, into which you pass your variables as parameters.
This blog article has a good tutorial.