HEY richard!

filter your  variables through addslashes($variable);


----- Original Message ----- 
From: "Richard D. Williams" <richard@a...>
To: "professional php" <pro_php@p...>
Sent: Friday, February 01, 2002 7:25 AM
Subject: [pro_php] apostrophe problem


> I have a php page that allows users to update a table of links to other
> sites.
> They select from a list of link names and can delete or update.  All is
> fine except
> if the link name contains an apostrohe.  Then, and only then, no values
> appear in my fields.  It's as though the query has failed.  Below is my
> query, $linksel
> is the link name selected by the user.
> 
> $queryA = "SELECT * FROM links WHERE name = '$linksel'";
> $linkA = mysql_query($queryA) or die("<font color=red>Links Lookup
> Failed! error-"
> . mysql_error() . "<br>\nquery - $queryA</font>");
> if ($myupdlink = mysql_fetch_array($linkA)) {
>       $name        = $myupdlink["name"];
>       $linkname   = $myupdlink["linkname"];
>       $descrp      = $myupdlink["descrp"];
>  }
> echo("<FORM METHOD='post' ACTION='" . $PHP_SELF . "'><table>
> <tr><td align='right'><b>Name:</b></td><td align='left'><input
> type='text' name='name' value='$name' size='70'></td></tr>
> <tr><td align='right'><b>http://www.</b></td><td align='left'><input
> type='text' name='linkname' value='$linkname' size='70'></td></tr>
> </table>
> <b>Description:</b><br>
> <textarea name='descrp' cols=80 rows=5>$descrp</textarea>
> 
> My other question having to do with apostrophes. I have a php script
> that read a text file and inserts data into a MySQL table.  If any of
> the fields from the text file contain an apostrophe, bam! it errors
> out.  Now I know the apostrophe is being read as the end of the insert
> query, but how can I avoid the error and still allow the apostrophe in
> the text file?
> 
> I hope all of this is within the realm of the group.  If it is more
> MySQL that php, please forgive me and ignore this these questions.   But
> , if any collegues out there have some input, please enlighten me.
> 
> Many thanks in advance,
> Richard D. Williams
> The Applications Group
> 
> 
>