mysql error when inserting post data

Question

I dont know where my error is in this mysql query

$sql = "INSERT INTO `events` ( `owner` ,  `title` ,  `tagline` ,  `location` ,  `street` ,  `citytown` ,  `startdate` ,  `enddate` ,  `active`  ) VALUES(  '{$username}' ,  '{$data[title]}' ,  '{$data['tagline']}' ,  '{$data['location']}' ,  '{$data['street']}' ,  '{$data['citytown']}' ,  '{$data['startdate']}' ,  '{$data['enddate']}' ,  '{$data['active']}'  ) "; 
mysql_query($sql) or die(mysql_error());

It tells my i have an error in the syntax near... and then outputs part of my data where i have apostrophes

(example: title = Dave's Party)

Community · Accepted Answer · 2023-11-17 20:42:18Z

2

You want to escape single quotes in your strings before you insert them into the database.

You'll probably want to use mysql_real_escape_string on each element of your $data array.

For example:

$escaped_data = array();

foreach ($data as $key => $val) {
    $escaped_data[$key] = mysql_real_escape_string($val);
}

$sql = "INSERT INTO `events` ( `owner` ,  `title` ,  `tagline` ,  `location` ,  `street` ,  `citytown` ,  `startdate` ,  `enddate` ,  `active`  ) VALUES(  '{$username}' ,  '{$escaped_data[title]}' ,  '{$escaped_data['tagline']}' ,  '{$escaped_data['location']}' ,  '{$escaped_data['street']}' ,  '{$escaped_data['citytown']}' ,  '{$escaped_data['startdate']}' ,  '{$escaped_data['enddate']}' ,  '{$escaped_data['active']}'  ) "; 
mysql_query($sql) or die(mysql_error());

As an aside, take a look at the PHP documentation for SQL injection.

edited Nov 17, 2023 at 20:42

CommunityBot

11 silver badge

answered Nov 2, 2009 at 12:46

Dominic Rodger

100k37 gold badges204 silver badges219 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2023-11-17 19:29:57Z

1

Be sure that you have all values properly escaped.

mysql_real_escape_string

edited Nov 17, 2023 at 19:29

CommunityBot

11 silver badge

answered Nov 2, 2009 at 12:50

Keiji

2451 gold badge4 silver badges7 bronze badges

Comments

Trevor · Accepted Answer · 2009-11-02 12:50:06Z

1

mysql_escape_string($data['title']);

or

mysql_real_escape_string($data['title'], $dbconn);

answered Nov 2, 2009 at 12:50

Trevor

6,6995 gold badges40 silver badges69 bronze badges

Collectives™ on Stack Overflow

mysql error when inserting post data

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related