Question

Iam taking a name from user to search in my database from page search.php.

<?php
 mysql_connect("localhost","root","");
mysql_select_db("amdsvcjdsvhck");
$re=$_GET['text'];

$sql="select sdf from contact where zip = '$re'";
$ess=mysql_query($sql);
$num=mysql_num_rows($ess);
for($i=0;$i<$num;$i++)
{$fow=mysql_fetch_assoc($ess);
echo '<div>'.$fow['zip'].'</div>' ; 
}
?>

Now this page is giving error when i pass single quote(‘) or backslash(\) in name.

Answer 1

Try:

$re=$_GET['text'];
$re = mysql_real_escape_string($re);
$sql="select sdf from contact where zip = '".$re."'";