PHP convert ' to html code

Question

My string $name = "Ali'Shan"; I want store it into database but the ' I use htmlentities/ htmlspecialchars and str_replace but insert I still get syntax error ' .

$name = "Ali'Shan";
str_replace("'", "", $name);
echo $name;

echo htmlentities($name);

My output is still Ali'Shan

' is not an entity for HTML purposes. It's a legitimate character. For putting into the database you use mysql_real_escape_string() or the appropriate equivalent for your DB. — virmaior
– virmaior, Commented Dec 28, 2013 at 11:27
Don't use mysql_real_escape_string, it forces you to use the mysql_ library, which is deprecated and will be removed from PHP. There are better alternatives. — Quentin
– Quentin, Commented Dec 28, 2013 at 11:33
You can use mysqli::real_escape_string it's an alternative like Quentin meant. — demonking
– demonking, Commented Dec 28, 2013 at 12:07

Sibiraj PR · Accepted Answer · 2013-12-28 11:29:01Z

1

Use addslashes() or mysql_real_escape_string()

answered Dec 28, 2013 at 11:29

Sibiraj PR

1,4811 gold badge10 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Quentin Over a year ago

Don't use addslahes, it is simply unsuitable. Don't use mysql_real_escape_string, it forces you to use the mysql_ library, which is deprecated and will be removed from PHP. There are better alternatives.

Community · Accepted Answer · 2017-05-23 11:59:44Z

1

Use htmlentities and htmlspecialchars when you want to insert text into an HTML document.

A database is not an HTML document. You need to use the appropriate mechanisms for adding text to an SQL query.

For the most part, those mechanisms are prepared statements with bound variables.

edited May 23, 2017 at 11:59

CommunityBot

11 silver badge

answered Dec 28, 2013 at 11:31

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Comments

Null · Accepted Answer · 2013-12-28 11:30:06Z

0

what about

str_replace("'", "\'", $name);

answered Dec 28, 2013 at 11:30

Null

1621 silver badge14 bronze badges

Comments

Amit · Accepted Answer · 2013-12-28 11:33:55Z

0

Use mysql_real_escape_string($str) while inserting in database.

answered Dec 28, 2013 at 11:33

Amit

3,3093 gold badges23 silver badges31 bronze badges

1 Comment

Quentin Over a year ago

Don't use mysql_real_escape_string, it forces you to use the mysql_ library, which is deprecated and will be removed from PHP. There are better alternatives.

Collectives™ on Stack Overflow

PHP convert ' to html code

4 Answers 4

1 Comment

Comments

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related