Question

$sql="SELECT `name` FROM $table ";

what happens if into the records from name column there are quotes (‘) ?
I need to change that SELECT query? And how? I noticed that Mysql reports an error like this:

1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘activation)” at line 3

’cause ‘activation is not good…
but well…why can i read and manipulate the string variable if it returns an error?
I saw exemples that use a WHERE condition…but I don’t need that, I have to select all the records from the name column… please help

edit:

//..connection to database part, then...


    $sql="SELECT `name` FROM $table ";
    $res=mysql_query($sql);


    $c=0;
    function contains($str, array $arr)
    {
        foreach($arr as $a) {
            if (stripos($str,$a) !== false) return true;
        }
        return false;
    }
    $arr = array("à","â","æ","ç","è","é","ê","ë","î","ï","ô","œ","ù","û","ü","¡","¿","ñ","í","ó","ú","ä","ö","ß","ÿ");
    while ($row = mysql_fetch_row($res)) {
        $contiene = 0;
        $link=strtolower($row[0]);
        $link = iconv('Windows-1252', 'UTF-8//TRANSLIT//IGNORE', $link);
        $link= utf8_decode($link);
        $link = stripslashes($link);
        $link = mysql_real_escape_string($link);
        if (contains($link, $arr)) {
            echo "String containing special char\n";
            echo "$link\n";         
            $link = str_replace("à", "a", $link);
            $link = str_replace("â", "a", $link);
            $link = str_replace("æ", "ae", $link);
            $link = str_replace("ç", "c", $link);
            $link = str_replace("è", "e", $link);
            $link = str_replace("é", "e", $link);
            $link = str_replace("ê", "e", $link);
            $link = str_replace("ë", "e", $link);
            $link = str_replace("î", "i", $link);
            $link = str_replace("ï", "i", $link);
            $link = str_replace("ô", "o", $link);
            $link = str_replace("œ", "oe", $link);
            $link = str_replace("ù", "u", $link);
            $link = str_replace("û", "u", $link);
            $link = str_replace("ü", "ue", $link);
            $link = str_replace("¡", "-", $link);
            $link = str_replace("¿", "-", $link);
            $link = str_replace("ñ", "n", $link);
            $link = str_replace("í", "i", $link);
            $link = str_replace("ó", "o", $link);
            $link = str_replace("ú", "u", $link);
            $link = str_replace("ä", "ae", $link);
            $link = str_replace("ö", "oe", $link);
            $link = str_replace("ß", "ss", $link);
            $link = str_replace("ÿ", "y", $link);
            echo "String with replaced char\n";
            echo "$link\n";
            $c++;
            $contiene = 1;
        }
        $link=ereg_replace("[^a-z0-9\-]", "-", $link);
        echo "String after ereplace:\n";        
        echo "$link\n"; 
        if ($contiene ==1){
            $l="UPDATE $table 
                SET link_rewrite='$link'
                WHERE $table.name = '$row[0]'   "; 
            $r=mysql_query($l);
            if (!$r) {
            echo mysql_errno() . ": " . mysql_error() . "\n";
            }
        }

    }

    echo "Update catlink_rewrite( $c )";

?>

what’s wrong?

String containing the accent or special char:

acer aspire one d270-n261g326ck noir + housse néoprène noir & rouge avec pochette frontale lneo-10 – jusqu’à 10,2″

String after str_replace:

acer aspire one d270-n261g326ck noir + housse neoprene noir & rouge avec pochette frontale lneo-10 – jusqu’a 10,2″

String after ereg_replace:

acer-aspire-one-d270-n261g326ck-noir—housse-neoprene-noir—rouge-avec-pochette-frontale-lneo-10—jusqu-a-10-2-

Mysql error:

1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘à 10,2″” at line 3

Answer 1

$row[0] = mysql_real_escape_string($row[0]);

Do this before the UPDATE query where the $row[0] is used. You are not escaping anything. Your code makes my eyes bleed… and is very unsafe.