PHP, mysql_real_escape_string and MySQL query

Question

I am getting an error with a query similar to this, but I have not figured out the problem:

$str = "rob's";
...
$query ="INSERT INTO tableName (name) VALUES (mysql_real_escape_string('$str')";

Edit:

I apologize. I made a mistake while reducing my code down; this is closer to what I have that is giving an error:

$str = "rob's";
...
$query ="INSERT INTO tableName (name) VALUES (('".mysql_real_escape_string($str)."')";

It's best to abandon the antiquated mysql_ functions and switch to a library that offers parameterized queries, e.g. PDO. — webbiedave
– webbiedave, Commented Apr 17, 2012 at 20:10
You have an extra bracket here VALUES(('".mysql_real_escape_string($str)."') should be like VALUES ('".mysql_real_escape_string($str)."'). Isn't it? — Lion
– Lion, Commented Apr 17, 2012 at 20:32
"I am getting an error" - what does the error message say? That's quite important information, wouldn't you say? — JJJ
– JJJ, Commented Apr 17, 2012 at 20:33

Rene Pot · Accepted Answer · 2012-04-17 20:03:42Z

4

mysql_real_escape_string()is PHP, not MySQL. You need to get it out of the quotes

$query ="INSERT INTO tableName (name) VALUES ('".mysql_real_escape_string($str)."')";

Also, $str is a string, so in MySQL it needs to be surrounded by qoutes too, I added them. You already had this in place, but because the function needed to get out of the quotes, they had to be moved

answered Apr 17, 2012 at 20:03

Rene Pot

24.8k7 gold badges70 silver badges92 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

MarcinJuraszek · Accepted Answer · 2012-04-17 20:04:09Z

1

$query ="INSERT INTO tableName (name) VALUES ('" . mysql_real_escape_string($str) . "'";

answered Apr 17, 2012 at 20:04

MarcinJuraszek

126k15 gold badges199 silver badges267 bronze badges

1 Comment

Lawrence Cherone Over a year ago

Your treating $str as a string

TazGPL · Accepted Answer · 2012-04-17 20:05:13Z

1

mysql_real_escape_string() is a PHP function. So in your MySQL query string you have to pass it like a variable:

$query ="INSERT INTO tableName (name) VALUES ('" . mysql_real_escape_string($str) . "')";

Read more here: http://php.net/manual/en/function.mysql-real-escape-string.php

answered Apr 17, 2012 at 20:05

TazGPL

3,7442 gold badges41 silver badges60 bronze badges

Comments

NightOwlPrgmr · Accepted Answer · 2014-08-13 15:32:32Z

I would recommend performing the mysql_real_escape_string() function prior to the insert query. There are known issues with attempting to strip characters during the query call. The code below I have utilized numerous times before and know it works. It would also help if you gave us the error you've been getting, are you using a mysql extension such as mysql*i*, and the real code you're using. "I made a mistake while reducing my code down; this is closer to what I have that is giving an error" doesn't really help narrow down the issue you're having since you possibly removed the piece that throws the error while reducing your code. Nevertheless, using what I have below should work for you just fine.

$str = $_POST['name'];
mysql_real_escape_string($str);
$query = "INSERT INTO tableName (name) VALUES (".$str.")";
mysql_query($query);

Collectives™ on Stack Overflow

PHP, mysql_real_escape_string and MySQL query

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related