Question

I’m using tinymce as my website’s text editor.

Whenever I try to add content using it, it works perfectly, but if theres a
' inside the text ( for example : “Can’t” ) I get the following error :

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '...

Answer 1

You’re not using Prepared Statements. This means that special characters such as ‘ will interfere with your SQL statements. Ultimately, this means that your code is open to SQL injections. Look into using Prepared Statements with PDO. Here’s a simple example from the manual:

<?php
$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':value', $value);

// insert one row
$name = 'one';
$value = 1;
$stmt->execute();

// insert another row with different values
$name = 'two';
$value = 2;
$stmt->execute();
?>