2006/4/26, dpgirago@xxxxxxxxxxxxxx <dpgirago@xxxxxxxxxxxxxx>: > > > > Skip Evans wrote: > > > >>Hello all, > >> > >>I'm brand spanking new to the list and have a > >>quick question. > >> > >>I was under the impression that addslashes() would > >>handle single quote marks in INSERT statements, > >>but when I execute the following: > >> > >>$sql="UPDATE images SET orderno=$orderno, > >>url='".addslashes($url)."', > >>banner=$banner,caption='".addslashes($caption)."' > >>WHERE imageID=$imageID"; > >> > >>...and $caption contains something like: > >> > >>"Don't look" > >> > >>...the data is chopped off at the single quote mark. > >> > >>How, if not addslashes(), does one handle this? > > > No, neither mysql_escape_string or > > mysql_real_escape_string worked. > > > > Yes, I am using MySQL, should have said that, sorry. > > > > But anyway, even with both of these functions, the > > data in the string containing the single quote as > > in "Don't Look" is still being truncated at the > > single quote mark. > > > > Any other suggestions would be greatly appreciated. > > > Skip > > For the archives: > > Subject of this thread is misleading since the problem was not one of an > INSERT failing but of HTML not displaying properly because of quotes or > other special characters in the text in the database. Just goes to show > that the best way to get the right answer is to analyze the problem > accurately and ask the right question. > > David Well, 80% of solving a problem is finding out what the problem is. If you ask them to solve that 80% on their own then asking for help is rather pointless. Anyway I agree that the subject was misleading, but this was caused by how he explained the problem, particularly on the assumption that addslashes was not doing what it was supposed to do so. What I advise is to avoid assumptions and just present the symptoms of the problem.
