Member Avatar for chaitu11 
$descrr = "Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum."



$descrr = stripslashes($_POST['descr']);

$insert = mysql_query("insert into offer(
    descr
    ) 
    values(
    '".$descrr."'
    )")
    or die(mysql_error($con));

Error while inserting description text:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's standard dummy text ever since the 1500s, when an unknown printer took a galle' at line 4
Edited by chaitu11
  • 2 Contributors
  • 2 Replies
  • 1K Views
  • 1 Hour Discussion Span
  • Latest Post Latest Post by chaitu11

Dani AI

Generated

The error text ("... near 's standard dummy text ...") shows the description string contains an unescaped single quote. As noted, escaping fixes the immediate syntax problem; 's quick fix is understandable for a one-off. For production code the safer, long-term approach is to keep SQL and data separate by using parameterized queries and a proper connection charset.

<?php
$pdo = new PDO(
  'mysql:host=localhost;dbname=yourdb;charset=utf8mb4',
  'dbuser',
  'dbpass',
  [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_EMULATE_PREPARES => false,
  ]
);

$stmt = $pdo->prepare('INSERT INTO offer (descr) VALUES (:descr)');
$stmt->execute([':descr' => $_POST['descr']]);
?>

When showing stored text in HTML, escape for output rather than removing slashes from the stored value:

echo htmlspecialchars($row['descr'], ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');

Notes and cautions: do not rely on magicquotes behavior (it was removed in PHP 5.4); avoid the old mysql* extension (use PDO or mysqli); ensure the connection and table use utf8mb4 to prevent charset-related issues; validate input length and handle errors with exceptions. See the PHP manual for guidance on prepared statements and safe output escaping: PDO prepared statements — htmlspecialchars.

Recommended Answers

All 2 Replies

Member Avatar for broj1

Your text contains an apostrophe (') which is also used in mysql as a string delimiter. In order to store an apostrophe into the DB you have to escape it usually using a database escape function (mysql_real_escape_string in your example):

$insert = mysql_query("insert into offer(
descr
)
values(
'".mysql_real_escape_string($descrr)."'
)")
or die(mysql_error($con));

All in all using deprecated mysql_* functions is a bad idea. Switch to PDO.

Edited by broj1
Member Avatar for chaitu11

Solved

while instering i used
$descrr = mysql_escape_string(trim($_POST['descr']));

while displaying
$descrr = stripslashes($row['descr']));

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.