replace string in php?

Question

This question is a bit basic and have been covered many times but I'm not sure why my code doesn't do anything. it doesn't update string at all.

this is my code:

$fineImage = "users_fav/".$_GET['id']."/$newname";


$icon = "<img src='images/icon.png' height='70' width='70'  />";

$sql = "UPDATE $lchat SET user_message = replace(user_message, '$icon', '$fineImage')";
$query = mysqli_query($db_conx, $sql);

the problem is that if I change the '$icon', '$fineImage' to something like 'david', 'mark'. it works fine and it will replace the david with mark...!

so why doesn't it work the way i do it?

When using mysqli you should be using parameterized queries and bind_param to add user data to your query. DO NOT use string interpolation to accomplish this because you will create severe SQL injection bugs. You're probably having some kind of quoting issue here due to your use of string concatenation. — tadman
– tadman, Commented Oct 7, 2014 at 20:52
I'd also be extremely careful when using variables like $lchat in your queries. Does this table name change? If not, put it in directly. Every variable you have in your query creates an opportunity for problems you do not want to have. — tadman
– tadman, Commented Oct 7, 2014 at 20:57

O. Jones · Accepted Answer · 2014-10-07 21:05:17Z

2

It's likely that your call to MySQL's REPLACE(input, before, after) is failing to find before in its input, so is returning input unmodified.

Why could this be? Several reasons:

user_message doesn't contain what you think it contains. For example, are the < and > tags entitized (that is, coded with < and the like)?
you're replacing a full <img..> tag with your $fine_image. Is $fineimage also an <img ...> tag?
your before parameter contains embedded single quote characters. That could conspire to make your SQL string invalid.

answered Oct 7, 2014 at 21:05

O. Jones

110k17 gold badges134 silver badges187 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Yash Sodha · Accepted Answer · 2014-10-07 21:02:28Z

0

Try this:-

$sql = "UPDATE {$lchat} SET `user_message` = replace(`user_message`, '{$icon}', '{$fineImage}')";

Make sure you have $lchat, $icon, $fineImage defined. :)

answered Oct 7, 2014 at 21:02

Yash Sodha

7033 silver badges13 bronze badges

Collectives™ on Stack Overflow

replace string in php?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related