Question

Possible Duplicate:
Best way to prevent SQL injection in PHP?

I’ve made a PHP script ectracting xml values and inserting them into a SQL DB.

However these strings have all kind of signs, backslash, %, *, ‘, etc. And usally i end up with an error.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL        server version for the right syntax to use near 's demanding business environment. 
Product Lin' at line 2

I have tried a few things like “stripslashes” etc. Bu i cant seems to find the commaned to “protect” the variable for interfering with my SQL.

Any ideas ?

Answer 1

If you are using old mysql_query() system you should use mysql_real_escape_string() before inserting a string into your SQL for escaping string. Like this :

$myStringEscaped = mysql_real_escape_string($myString);