Member Avatar for ahmksssv

Hi frnds....

i am inserting bulk data into database...here i phase small problem...when the data having (') single quotes it shows error...because php takes ' as many ways.....

i think htmlentites() tag is there in php...i dont know how it uses perfectlyy...
plz resolve this problem asap..

  • 1 Contributor
  • 1 Reply
  • 87 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by ahmksssv

Dani AI

Generated

As discovered, single quotes in input will break SQL when data is inserted raw. Escaping functions can stop the immediate error, but the recommended, long-term approach is to use parameterized queries (prepared statements). Prepared statements let the database driver handle quoting and binary data, and they remove the need to manually escape single quotes while also protecting against SQL injection (PDO prepared statements, MySQLi prepared statements).

Example (PDO): 

$pdo = new PDO('mysql:host=localhost;dbname=app;charset=utf8mb4', 'user', 'pass', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_EMULATE_PREPARES => false,
]);

$stmt = $pdo->prepare('INSERT INTO items (name, description) VALUES (:name, :desc)');
$pdo->beginTransaction();
foreach ($rows as $r) {
    $stmt->execute([':name' => $r['name'], ':desc' => $r['description']]);
}
$pdo->commit();

Practical tips: set the connection charset to utf8mb4 to avoid encoding bugs; reuse one prepared statement for bulk inserts and wrap them in a transaction for much better performance; do HTML escaping (for example with htmlspecialchars) only when outputting data to a page, not before storage (htmlspecialchars). For a concise security checklist see the OWASP SQL Injection Prevention Cheat Sheet (OWASP). If the codebase still uses the very old mysql extension, plan a migration to PDO or MySQLi.

Member Avatar for ahmksssv

hi frnds..

sry 4 distrubing u...

mysql_real_escape_string($data);

this is the solution....

Thank u..

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.