how to insert special character in mysql via php and display on html page

Question

how to insert special characters into a database(MySQL) like

Registered symbol ( ® ) OR Copyright sign ( © ) OR Trade Mark sign ( ™ )

Also I want to display as original on the html page.

What I have to do in both side (front end and back end), please elaborate

Which function is more effective?

Method 1:

$_GET = array_map('trim', $_GET);
$_POST = array_map('trim', $_POST);
 
if(get_magic_quotes_gpc()){
  $_GET = array_map('stripslashes', $_GET);
  $_POST = array_map('stripslashes', $_POST);  
  
  $_GET = array_map('strip_tags', $_GET);
  $_POST = array_map('strip_tags', $_POST);  
 }
 else{
  $_GET = array_map('mysql_real_escape_string', $_GET);
  $_POST = array_map('mysql_real_escape_string', $_POST);   
 }

Method 2:

  foreach ($_POST as $key=>$value){
        if (!get_magic_quotes_gpc()) {
          return addslashes(htmlentities(strip_tags($value),ENT_QUOTES,'UTF-8'));
          } 
          else {
             return htmlentities(strip_tags($value),ENT_QUOTES,'UTF-8');
          }
  }

I am a bit confused what is the difference between

htmlentities() and htlspecialchars(), and which one i have to use?

which function should be used addslashes() or stripslashes() when insert into database?

Community · Accepted Answer · 2020-06-20 09:12:55Z

4

Just simply add those symbols to your text, and execute it as SQL query:

INSERT INTO tbl_name VALUES ("Here's my text: ©®");

When you want to display it one the website don't do anything with these symbols (but remember to escape at least <, >, & (using htmlspecialchars()) cause those has special meaning in XML/SGML (HTML) documents)

PS. Also remember to escape text passed to SQL query using mysql_real_escape_string() to avoid any SQL Injection problems. If your server has magic_quotes_gpc enabled disable it or at least filter your GET/POST/COOKIE data to its raw value. You should always consciously escape values.

EDIT:

According to your comment... I don't remember whether magic_quotes_gpc are enabled by default but you can easily undone magic quotes effect. Just on the very beginning of your PHP code add something like this:

if (get_magic_quotes_gpc()) {
  array_walk_recursive($_GET, 'stripslashes');
  array_walk_recursive($_POST, 'stripslashes');
  array_walk_recursive($_COOKIE, 'stripslashes');
}

Now each GPC value should be always raw - without quotes - so you have to escape it manually before passing any variable into query.

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Jan 23, 2010 at 11:20

Crozin

44.5k13 gold badges92 silver badges136 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

xkeshav Over a year ago

how do i insert direct input???? i have to insert other fields also, it is not asingle filed in databse and how do i use this query?? does php latest version add slash by default?? this is totally rubbish

xkeshav Over a year ago

should i use array_walk_recursive() or array_walk()

Crozin Over a year ago

GPC arrays can be multidimensional so you have to use array_walk_recursive().

Community · Accepted Answer · 2017-05-23 12:19:32Z

2

From the PHP docs for htmlentities():

This function is identical to htmlspecialchars() in all ways, except with htmlentities(), all characters which have HTML character entity equivalents are translated into these entities.

Don't worry about encoding things when you store them: store the data raw, and then encode it with htmlentities() when you display it in your HTML.

Edit: Also, read this.

edited May 23, 2017 at 12:19

CommunityBot

11 silver badge

answered Jan 23, 2010 at 10:54

Mark Bell

29.8k26 gold badges121 silver badges150 bronze badges

Comments

John Parker · Accepted Answer · 2010-01-23 10:55:41Z

2

For starters, you should just use mysql_real_escape_string when inserting into the database - this will ensure that whatever you store is safely encoded, yet retains all of the original information.

In terms of output, the key difference between htmlentities and htmlspecialchars is that htmlentities will convert all characters that have entities whereas htmlspecialchars will only convert <, >, &, ", '

answered Jan 23, 2010 at 10:55

John Parker

54.5k11 gold badges133 silver badges131 bronze badges

Comments

Vaibhav Tomar · Accepted Answer · 2019-05-30 23:00:16Z

-1

Just use prepared statements.

$con = <"Your database connection">;
$input = "What's up? ®, ©, ™";
$stmt = $con->prepare("insert into `tablename` (`field`)values(?)");
$stmt->bind_param("s",$input);
$stmt->execute();

answered May 30, 2019 at 23:00

Vaibhav Tomar

1371 silver badge6 bronze badges

Collectives™ on Stack Overflow

how to insert special character in mysql via php and display on html page

Method 1:

Method 2:

4 Answers 4

EDIT:

3 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

Method 1:

Method 2:

4 Answers 4

EDIT:

3 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest