Question

I have a php script that inserts values into mySQL table

INSERT INTO stories (title) VALUES('$_REQUEST[title]);

I checked the values of my request variables before going into the table and it’s fine.

But when I add title=john to the table for example,

I get something like this:
title = "[][][][]john"
and when I extract the value, it’s a newline then john.

I have my columns set to utf-8, I tried swedish character set as well.

Note: I don’t get this error when inserting values from the phpMyAdmin commandline

Answer 1

You need {} around any array notation when used inside "".

$q="INSERT INTO stories(title) VALUES('{$_REQUEST['title']}')";

BTW, it would be better, when checking your $_REQUEST vars to store the sanitized versions in new variables, and to be sure to escape them with real_escape_string()