PHP-MySQL problem

Hi,

I have the following code:

PHP: Select all

$sec = "Répertoires d'objets multimédias";

mysql_query("SELECT * FROM dir WHERE sec=\"$sec\" ORDER BY st ASC",$db); 

and it returns 0 rows. When I use another $sec value, one that doesn't contain an apostrophe ('), it returns normal rows. How can I fix that?

Thanks.

Robert

The proper way to do this is to espace the '. To do so simply call addslashes.

Code: Select all

$sec = "Répertoires d'objets multimédias";
$sec = addslashes($sec);
mysql_query("SELECT * FROM dir WHERE sec=\"$sec\" ORDER BY st ASC",$db);  

mysql_real_escape_string is better as it uses the mysql connection but it is not necessary unless the input is from the user. However, when using mysql_real_escape_string you have to make sure the value is not numeric.

That is easily done but using the is_numeric function like so:

Code: Select all

if(!is_numeric $variable)
{
    $variable = "'" . mysql_real_escape_string($variable) . "'";
}

But that is only necessary when the input is coming from user and you wish to protect against sql injection.

A.