mysql_real_escape_string not letting string through

Question

I'm trying to sanitize a string going into my database. But with the code below, I don't get the update to my db.

First page posts this in an input form:

$note="Here is some example text";

Receiving page:

$note = $_POST['note'];
$note = mysql_real_escape_string($note);
$sql="UPDATE some_table SET notes='$note' WHERE id='$some_id'";
$result=mysql_query($sql);

When I take out the mysql_real_escape_string line it works, but not with it in there. What am I missing?

Thanks!

Please do not use the mysql library as it is deprecated in favor of mysqli or PDO. — j883376
– j883376, Commented Jun 10, 2013 at 23:24

tadman · Accepted Answer · 2013-06-10 23:43:27Z

1

I strongly recommend using Prepared Statement, mysql_real_escape_string() won't full protect you from SQL Injection.

Example for your update:

<?php
// connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

// query
$sql = "UPDATE some_table 
        SET notes=? 
        WHERE id=?";
$q = $conn->prepare($sql);
$q->execute(array($$_POST['note'], $some_id));
?>

More details: http://www.php.net/manual/en/intro.pdo.php

edited Jun 10, 2013 at 23:43

tadman

212k23 gold badges237 silver badges266 bronze badges

answered Jun 10, 2013 at 23:31

Wils

1,21118 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

mysql_real_escape_string not letting string through

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related