Question

Im using the follow script to insert records into my DB:

$sql = "INSERT INTO fotetweets VALUES('$tweetid','$dp', '', '$username','$tag', '$twittercontent', '$twittertimestamp', '')";
mysql_query($sql);

However what if $twittercontent contains the ' char, I think it will fail. Correct?

If so how can I deal with it correctly?

Answer 1

You will want to look into mysql_real_escape_string. However, I would look into using the mysqli or PDO class instead and utilize prepared statements.

EDIT

Note, these can all be found / were pretty much taken from the PHP Manual under examples for prepared statements.

Example Usage for MySQLi:

<?php
$mysqli = new mysqli("localhost", "my_user", "my_password", "my_database");

/* check connection */
if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}

/* create a prepared statement */
$stmt =  $mysqli->stmt_init();
if ($stmt->prepare("INSERT INTO fotetweets VALUES(?, ?, '', ?, ?, ?, ?, '')")) {
    /* bind parameters for markers */
    $stmt->bind_param("issssi", $tweetid, $dp, $username, $tag, $twittercontent, $twittertimestamp);

    /* execute query */
    $stmt->execute();

    /* close statement */
    $stmt->close();
}
?>

Example Usage PDO:

<?php
$dsn = 'mysql:dbname=testdb;host=127.0.0.1';
$user = 'dbuser';
$password = 'dbpass';

try {
    $dbh = new PDO($dsn, $user, $password);
} catch (PDOException $e) {
    echo 'Connection failed: ' . $e->getMessage();
}

$sth = $dbh->prepare('INSERT INTO fotetweets VALUES(?, ?, '', ?, ?, ?, ?, '')');
$sth->execute(array($tweetid, $dp, $username, $tag, $twittercontent, $twittertimestamp));
?>

Example of mysql_real_escape_string usage:

$tweetid = (int) $tweetid; // static cast to integer, if that is what it should be.
$sql = "INSERT INTO fotetweets VALUES(
    $tweetid,'" . mysql_real_escape_string($dp) . "', 
    '', '" . mysql_real_escape_string($username) . "', 
    '" . mysql_real_escape_string($tag) . "', 
    '" . mysql_real_escape_string($twittercontent) . "', 
    '" . mysql_real_escape_string($twittertimestamp) . "', '')";

You can find more information and extra usage examples at the manual pages listed above. Given I do know what $dp is I cannot tailor this exactly.

SIDE NOTE

This is all the assumption I am willing to make. The OP could be getting the data from POST and/or in an array form, or he could be getting it from a different means. Either or, given the example the OP posted, this is as accurate as I could be to tailor to the OP. If you have an issue or think it could be better explained / shown, well go ahead and add another answer which addresses it and not just another complaining comment remark about how no one does anything right when you are not willing to pony up the “correct” answer yourself.

And of course if it is an array, this changes a lot of items and the OP should clear that up and not just random people making “guesses” as to where and how the data is being retrieved.