How to store CKEditor data into MySQL?

Question

I have CKEditor and want to send its data to the server in order to store it in MySQL. I am able to send source code (data) of CKEditor to the server with jQuery Ajax but when I try to execute my SQL query in order to store it in the database the insert command gives error. I think the main problem here is that CKEditor data contains new lines in it. How to solve this problem?

I have found this question similar to mine, but when I tried it and it didn't work for me. And I didn't understand what does mysql_prep function do, because it is not standard PHP function.

update 1

The code for the HTML form is following:

$("#save").click(function(){
    var data = $( '#editor1' ).val();                                        
    $.ajax({
        type:"POST",
        url:"save.php",
        data: "editor1="+data,
        timeout:15000, 
        error:function(XMLHttpRequest, textStatus, errorThrown){
          alert("ERROR");                            
        },
        success:function(response){
          alert("Success: "+response);
        }
    });                           
})

And the save.php has following codes:

<?php
   include '../config.php'; //connecting to DB 
   $title='news 1'; $author=1; $date="2011/08/08"; $categories='1,2,3';     
   $short_text=$_POST['editor1']; $full_text=$_POST['editor1'];    
   $sql=sprintf('insert into news values(null,"%s",%d,"%s","%s","%s","%s")',$title,$author,$date,$short_text,$full_text,$categories);
   mysql_query($sql) or die("Error in $sql");
?>

What does the MySQL error say? And you should be escaping the code — Kerry Jones, Aug 08 '11 at 19:19
Also, if I'm not mistaken, MySQL likes single quotes, not double. — Kerry Jones, Aug 08 '11 at 19:19

score 0 · Answer 1 · answered Jun 23 '17 at 16:54

Little bobby tables says that you are very vulnerable to SQL Injection. The simplest way to both mitigate SQL injection and fix any issues with newlines is to use prepared statements. At the very least you need to be escaping your input, which would also fix issues with newlines. You could use mysql_real_escape_string, except of course that was deprecated years ago, so for recent work you should at least be using the mysqli* functions (and then use prepared queries while you are at it).

score -1 · Answer 2 · answered Aug 13 '15 at 05:42

-1

-Use this

$short_text= htmlspecialchars($_POST['editor1']);

answered Aug 13 '15 at 05:42

Muhammad Sadiq

1,147
11
13

htmlspecialcharacters won't fix it: it won't actually remove the newlines, and it will completely kill the purpose of the ckeditor. ckeditor is a wysiwyg editor that is designed to build HTML code to be outputted to a web page. If you then run it through htmlspecialchars, all that HTML will no longer be able to be outputted to a webpage. – Conor Mancone Jun 23 '17 at 16:55

How to store CKEditor data into MySQL?

2 Answers2