mfawcett at tir dot com
25-Apr-2000 03:45
For a MySQL problem (where a user might put quotes in a text field from a
form) use addslashes() to escape all quotes (single and double). For
example:
// Assuming 'textstuff' is from a form
$mytextstuff =
addslashes($textstuff);
$sql = "insert into MyTable set
MyField='$mytextstuff'";
Also if you are working with html
forms and/or text fields from databases a lot you'll probably want to read
up on commands like htmlspecialchars() as well (a field like
"foo<bar>" might not throw MySQL off but it won't display
correctly in an html page).