Skip Evans wrote:
I was under the impression that addslashes() would handle single quote marks in INSERT statements, but when I execute the following: $sql="UPDATE images SET orderno=$orderno, url='".addslashes($url)."', banner=$banner,caption='".addslashes($caption)."' WHERE imageID=$imageID"; ...and $caption contains something like: "Don't look" ...the data is chopped off at the single quote mark. How, if not addslashes(), does one handle this?
Change the contents of $sql to use double quotes around the strings instead of single - that's what real_escape_string was designed to escape. Alternatively use str_replace to escape single quotes.
-Stut -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
