Member Avatar for chaitu11 
$descrr = "Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum."



$descrr = stripslashes($_POST['descr']);

$insert = mysql_query("insert into offer(
    offer_title,
    price,
    descr
    ) 
    values(
    '".$offer_name."',
    '".$price."',
    '".$descrr."'
    )")
    or die(mysql_error($con));




You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's standard dummy text ever since the 1500s, when an unknown printer took a galle' at line 4
Edited by pritaeas because: Closed duplicate thread.
  • 3 Contributors
  • 2 Replies
  • 793 Views
  • 58 Minutes Discussion Span
  • Latest Post Latest Post by pritaeas

Dani AI

Generated

Short diagnosis and a safe fix.

As discovered and as pointed out, the error comes from an unescaped single quote (apostrophe) inside the description — when you put raw text into a single-quoted SQL literal the quote breaks the statement. SQL string literals must have internal quotes escaped (or the value supplied separately to the query driver). (dev.mysql.com)

Using stripslashes() does not solve this: stripslashes() only removes backslashes and is not a safe way to prepare user data for SQL. Relying on magic quotes or manually removing slashes is brittle; magic quotes were deprecated/removed in later PHP versions and should not be relied upon. (php.net)

Best practice: stop using the old mysql_* functions (they were deprecated and removed) and use prepared statements with PDO or MySQLi so user input is bound separately from SQL text. Prepared statements eliminate the need to escape embedded quotes and prevent SQL injection. Move to PDO or mysqli prepared statements as soon as possible. (php.net)

Example patterns (brief):

// PDO (recommended)
$db = new PDO('mysql:host=localhost;dbname=yourdb;charset=utf8mb4', $user, $pass, [
  PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
]);
$stmt = $db->prepare("INSERT INTO offer (offer_title, price, descr) VALUES (:title, :price, :descr)");
$stmt->execute([':title'=>$title, ':price'=>$price, ':descr'=>$descr]);
// mysqli (prepared)
$mysqli = new mysqli($host,$user,$pass,$db);
$stmt = $mysqli->prepare("INSERT INTO offer (offer_title, price, descr) VALUES (?, ?, ?)");
$stmt->bind_param('sds', $title, $price, $descr);
$stmt->execute();

If a migration to prepared statements is impossible immediately, escape user strings with the connection-aware escape function (e.g. mysqli_real_escape_string) after setting the connection charset — treat that as temporary only. (php.net)

(Topic closed as duplicate by — follow the modern-PDO/mysqli route linked above.)

Recommended Answers

All 2 Replies

Member Avatar for DaveAmour

Probably the apostrophe in industry's

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.