PHP && MYSQL - Insert data from textfield

[majidemo]

Ok I have this problem that I've never had before, it's really bugging me.

Basically I'm trying to submit text into a text field using a form. For some reason when I submit it with raw text and full-stops only it works fine, however it seems that when there is punctuation like a ' or a ! in the textarea then it just won't submit to the database. No errors are shown but there is just no result.

 

[Putako]

striptags, I think.. I don't really understand this question.

 

[majidemo]

i found this

Passing data to and from a from, PhP and mySQL is always a problem! Each converts what it receives in its own format.
You can try to insert into mysql using these functions:
htmlentities ($textfield)
htmlentities ( addslashes ($textfield) )
When retrieving:
$textfield = stripslashes ($field)
Look at htmlentities in www.php.net: there are many other functions.
If it is only spaces, you can also use
$textfield = str_replace (" ","_",$textfield) that will keep the spaces as "_".
When retrieving, use
$textfield = str_replace ("_"," ",$textfield) to do the reverse.
or: $textfield = str_replace ("_"," ", $textfield).
This later one will return FORCED HTML spaces...

but is their any alternative?

---------- Post added at 07:01 PM ---------- Previous post was at 06:59 PM ----------

striptags, I think.. I don't really understand this question.

thanks anyways to make it clear.

i want to insert the textfield data to mysql. but it will show an error.

i have a feeling its because the data in the text field contains " quotemarks ", w/c can mean the end of query..

example in my textfield is
This is a text field data by me a.k.a "majidemo".

now in query it will error at majidemo because it will end there.

 

[Putako]

i found this

Passing data to and from a from, PhP and mySQL is always a problem! Each converts what it receives in its own format.
You can try to insert into mysql using these functions:
htmlentities ($textfield)
htmlentities ( addslashes ($textfield) )
When retrieving:
$textfield = stripslashes ($field)
Look at htmlentities in www.php.net: there are many other functions.
If it is only spaces, you can also use
$textfield = str_replace (" ","_",$textfield) that will keep the spaces as "_".
When retrieving, use
$textfield = str_replace ("_"," ",$textfield) to do the reverse.
or: $textfield = str_replace ("_"," ", $textfield).
This later one will return FORCED HTML spaces...

but is their any alternative?

---------- Post added at 07:01 PM ---------- Previous post was at 06:59 PM ----------



thanks anyways to make it clear.

i want to insert the textfield data to mysql. but it will show an error.

i have a feeling its because the data in the text field contains " quotemarks ", w/c can mean the end of query..

example in my textfield is
This is a text field data by me a.k.a "majidemo".

now in query it will error at majidemo because it will end there.

Make sure in the database the table is TEXT

 

[majidemo]

Make sure in the database the table is TEXT

yes the table is text.. the problem is not the database, its the query.. please refer to first post i edited it.

 

[Putako]

yes the table is text.. the problem is not the database, its the query.. please refer to first post i edited it.

Ahh sorry I am tired. Try this string $str [, string $allowable_tags

 

[majidemo]

Ahh sorry I am tired. Try this string $str [, string $allowable_tags

thanks, its no problem.. you should take rest.. anyways, i will try this now

so this is my query

$sql="INSERT INTO anime_info (AnimeTitle, Animefimg, AnimeAltTitle, AnimeGenre, AnimeAllEpisodes, AnimeType, AnimeRday, AnimeRmonth, AnimeRyear, AnimeFday, AnimeFmonth, AnimeFyear, AnimeSynopsis)
VALUES
('$_POST[title]','$_POST[fimg]','$_POST[alttitle]','$_POST[genre]','$_POST[allepisodes]','$_POST[type]','$_POST[rDay]','$_POST[rMonth]','$_POST[rYear]','$_POST[fDay]','$_POST[fMonth]','$_POST[fYear]','$_POST[synopsis]')";

the last part w/c is synopsis is the part where i use a textfield.

can you help me with the syntax?

 

[Putako]

Are you telling me to take rest cause I am up at 4 am posting like a maniac? lmao of course I can. Don't worry I slept lmao

 

[majidemo]

i actually dont know what time it is there im from +8GMT, so its 7pm here.. anyways, i updated the last reply i gave.. im new to php tho

 

[Putako]

I can help.

---------- Post added at 11:27 AM ---------- Previous post was at 11:26 AM ----------

msn - [email protected]

 

[majidemo]

help anyone?

 

[holthelper]

make each $_POST look like this:

'".$_POST[array]."'

 

[s-p-n]

Dude, you're injecting yourself.. Look into MySQLi, the MySQL_ extension is going obsolete.

Hackers can do this to compromise your server.

Holthelper, I'm surprised at you..?

Putako.. Strip_tags are for XSS injections, and don't server any purpose or solution in terms of MySQL.


You can throw post data into the database without explicitly escaping it, but use parameterized queries for the easiest way. (MySQLi.)

 

[holthelper]

im bored lol. im making a script right now to download porn from my fav site LOLOL