Can't Save MySQL Query

Question

I'm having an issue with my MySQL query/php, I try to update a row in my database that will work usually, but when the string has a ' in it, for example

I don't like green eggs and ham.

The ' in it will cancel the whole response out and not update the row, so if I put something like this without the ' for example:

I dont like green eggs and ham.

The string will save to the row. Below is the MySQL query used and where I get the string from.

$NewMessage = $_POST['message123'];

mysql_query("UPDATE Account SET `function` = 'Message', `note` = '$NewMessage' WHERE `id` = '$ID' AND `Online` = '1'");

If you need anymore source or anything, please let me know, let me know what you think, thanks!

**STOP** using deprecated `mysql_*` API. Use `mysqli_*` or `PDO` with prepared statements. — Jens, Sep 04 '15 at 07:43
@AbhikChakraborty Wow, forgot all about that, thanks it worked 100%, the smallest things slip me sometimes! — Melternet, Sep 04 '15 at 07:44
@Jens Will be using that starting in a few days, this is just for testing, thanks! — Melternet, Sep 04 '15 at 07:45
@Melternet It makes no sence to test with this sollution and then change to an other which is so much differend — Jens, Sep 04 '15 at 07:49
@Jens I'm working on an old project of mine that was made in my early years, I'm currently tweaking it and testing, then I'm going to upgrade the MySQL to `PDO` or `MySQLI`. — Melternet, Sep 04 '15 at 07:51

score 0 · Answer 1 · answered Sep 04 '15 at 07:43

0

Use *_real_escape_string

$NewMessage = mysql_real_escape_string($_POST["message123"]);

But of course, mysql_* API is already deprecated and I would recommend to you to use prepared statement instead.

answered Sep 04 '15 at 07:43

Logan Wayne

6,001
16
31
49

Will be using `PDO` very soon, this is just for testing, thanks! – Melternet Sep 04 '15 at 07:46

score 0 · Answer 2 · answered Sep 04 '15 at 07:46

Hey friend you are need to change single ' with '' commas 2 times. then it is insert your value correct in table other generate error.

Real escape string use where we are need value like this doest. if we user value in database like it does't then right one is use '' 2 time single commas no doule commas

score 0 · Answer 3 · answered Sep 04 '15 at 07:47

0

Use simply addslashes() To read more about it click here

E.g in you code simply use addslashes() something like this

$NewMessage = addslashes($_POST['message123']);

I hope it will work for you.

answered Sep 04 '15 at 07:47

Yatin Khullar

1,580
1
12
26

Can't Save MySQL Query

3 Answers3