apostrophes are breaking my mysql query in PHP

php mysql apostrophe
Drew picture Drew · Dec 25, 2009 · Viewed 18.4k times · Source

My database has name records that occasionally contain apostrophes, such as Joe's Bar and I've just coded a query script in PHP that grabs that field and sticks it into a select statement with the usual $query = "SELECT address FROM restaurants WHERE name='$name'"; and the apostrophe in some of the restaurant names derails the Love Train.

How do I keep this from happening?

Snide answer - Use the same technique you used when you inserted them INTO the database via PHP.
Rebuttal - I was having the same problem then and cheated and entered the troublesome ones directly using PHPMyAdmin but this can't be ignored any longer.

Thank you for taking the time to answer this during the holidays.

Answer

styts picture styts · Dec 25, 2009

You have to $name = mysql_real_escape_string($name); before that line.

You might also want to read up on SQL Injections, since your inputs are clearly unsanitized.

Related questions

Mysql + php with special characters like '(Apostrophe) and " (Quotation mark)

I have been struggling with a small problem for a while. It's been there for years but it's just been an irritating problem and not a serious one, and I have just worked around it. But now I want to …

Read More
MySQL real escape string

I was trying to sanitize inputs to my PHP login using addslashes and mysql_real_escape_string. Using addslashes works, but mysql_real_escape_string will not. Here's an example of what allows me to log in correctly: $user = addslashes($_…

Read More
How can I prevent SQL injection in PHP?

If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example: $unsafe_variable = $_POST['user_input']; mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')"); That's …

Read More