Question

Ok I am pulling my hair out over this, There is no help on google at all for this,

if (isset ($_GET['comment']))

    $commentEntered = $_GET['comment'];

else

    $commentEntered = "refuse"; 

Above I get the variable Then I pass it to the database with the code below, Yes I know its in danger of injection.

$sql = "insert into $DB_Table (comment) values('$commentEntered');";

$res = mysql_query($sql,$con) or die(mysql_error());

mysql_close($con);

if ($res) {

    echo "success";

}else{

    echo "faild";
}

So When I enter a sentence into a text box it passes it to this php file. The GET method gets the comment entered and stores it in $commentEntered

Now when I enter one word into the text box the comment is stored no problem. But when I enter multiple words separated by a space it wil not work.

Any ideas?

Answer 1

Find out whats happening before it hits the query.

var_dump($commentEntered)

My bet is the URL contains a space and not %20, thus $commentEntered is everything before the first occurrence of a space. Find out by debugging. The only way to fix this is to escape the characters before it hits the script.