Question

I have an sql insert script that updates the sql table in the database when a user types text in a text area, but if a user uses an apostrophe in their text this will not insert the information into the table. this is because sql reads the apostrophe as a closing statement or whatever. but is there a way to use a statement that will allow users to put apostrophes in, i.e. tell sql to use ‘%s%’ or whatever to represent an apostrophe?

Heres the sql update code I’m using:

   <?php 

session_start();

include '_config/connection.php'; 

$status = $_POST['status'];

$result = mysql_query("SELECT status FROM ptb_profiles WHERE id=".$_SESSION['user_id']."");





if(!$result) 
{ 
echo "The username you entered does not exist"; 
} 
else 
if($status!= mysql_result($result, 0)) 
{ 
echo ""; 


    $sql=mysql_query("UPDATE ptb_profiles SET status ='$status' WHERE id=".$_SESSION['user_id'].""); 
}
    if($sql) 
    { 


}
header('Location: http://localhost/ptb1/profile.php?id=' . $_SESSION['user_id'] );
?>

Answer 1

Couldn’t you just escape the apostrophe? It’s standard practice to use mysql_real_escape_string() when shoving data into mysql_query()s.