Question

I pass a string into this function:

function linkify($text) {

  $text = eregi_replace('(((f|ht){1}tp://)[-a-zA-Z0-9@:%_\+.~#?&//=]+)',
    '<a href="\\1">\\1</a>', $text);
  $text = eregi_replace('([[:space:]()[{}])(www.[-a-zA-Z0-9@:%_\+.~#?&//=]+)',
    '\\1<a href="http://\\2">\\2</a>', $text);
  $text = eregi_replace('([_\.0-9a-z-]+@([0-9a-z][0-9a-z-]+\.)+[a-z]{2,3})',
    '<a href="\\1">\\1</a>', $text);

  return $text;

}

and I try to insert the text into a field in a database which is a varchar of 500 characters and I get an error, and the text cant be inserted, but when I don’t use the function I don’t get any errors.

Any ideas?

EDIT:
Here’s the error I am getting:

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'http://sitename.com/alpha/">http:/sitename.com/alpha/' at line 1"

Therefore it IS a problem with the function linkify…Appreciate help with fixing the syntax error ..looks like something with double quotes vs single quotes??
Thanks!

Answer 1

Based on your error message it is almost certain that you are not escaping the data before you insert it

I will assume you are using mysql for this example

$value = mysql_escape_string($text);
$sql = "INSERT INTO TABLENAME (COLNAME) VALUES ('$value')";
mysql_query($sql) or die(mysql_error());