Question

Possible Duplicate:
apostrophes are breaking my mysql query in PHP

I asked a friend to test my site and his surname had a ‘ . O’Rourke so I got error with syntax around Rourke. Obviously caused by the apostrophe.

How do I prevent this from happening so he can register to my site?

$name = $user_profile[name];

mysql_select_db("gamedb", $con);

$sql="INSERT IGNORE INTO Users (FID, Name, Date) VALUES ('$fid','$name',NOW())";

Does escaping solve the issue? I couldn’t actually try escaping it since the name is retrieved from the usr facebook account.

Thanks

Answer 1

Use Prepared statements. That’ll automatically handle input escaping. The current INSERT is open to a SQL injection attack. Check out mysqli_stmt::prepare()