MySQL/PHP Error: Input a value with an apostrophe ( ' )

Question

So I have this particular feature in my program wherein I want it to count all the Malls with value = 2 Robinson's Manila. However, there is an error since the apostrophe is seen by the program as a closing mark for the text.

Here's my code for that particular feature:

 <form action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>" method="GET">
        <select name="formStats">
            <option value="Rob">Robinson's Manila Stores</option>
            <option value="MoA">Mall of Asia Stores</option>
            <option value="GG">Greenbelt/Glorietta Stores</option>
        </select> 

        <input type="submit" name="formSubmit" value="Submit"/>
    </form>

    switch ($varStats)
    {   
        case "Rob": $show = "Mall = '2 Robinson's Manila'"; break;
        case "MoA": $show = "Mall = '3 Mall of Asia'"; break;
        case "GG": $show = "Mall = '1 Glorietta/Greenbelt Complex '"; break;
    }

I think I need to use the ` mark but I'm not sure with the exact syntax.

Possible duplicate of [How can I prevent SQL-injection in PHP?](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Jocelyn, Jul 04 '16 at 19:05

score 1 · Accepted Answer · answered Jul 04 '16 at 08:23

1

the problem is the apostrophe "Robinson's" in the assignment to the $show variable in the switch case. You should escape it writing "Robinson\'s"

answered Jul 04 '16 at 08:23

ddb

2,423
7
28
38

it it worked, please, set my answer as a solution for your question :) thanks a lot! – ddb Jul 04 '16 at 08:34

score 1 · Answer 2 · answered Jul 04 '16 at 08:29

1

You can use mysqli_real_escape_string() function to escapes special characters in a string for use in an SQL statement.

answered Jul 04 '16 at 08:29

Alok Patel

7,842
5
31
47

MySQL/PHP Error: Input a value with an apostrophe ( ' )

2 Answers2