Anybody know what causes this error in MySQL
 

When users try to add a listing by typing into a text box and they use any word with a ' so if they type sort's it comes up saying that there is an error in MySQL

Anbody know what causes this or how to fix it


cheers

Yeah. Use this:

http://php.net/manual/en/function.my...ape-string.php

what is the error?

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'S

Thanks Ill take a look at that

you need to "clean up" your variables by escaping those things that causes mysql to throw up.

$insertthisnowtomysql = mysql_real_escape_string($sometextforinsert)

now just run "INSERT" sql

so its the script and not mysql... cheers

its the ' use " instead

like someone said earlier, just escape the input before putting it in the db...

but that error isn't just some inconvenience, it can often be exploited to hack the script... I would have someone look into it...

trouble is its the users that are using ' and not " when they are typing things like mod's

Like woj said, those users can do more than just cause an error, a few cleverly placed 's from malicious users and you can kiss your data goodbye. I wrote this a few weeks ago:

http://www.embracer.com/2009/databas...sql-injections

Thanks

Im not very good when it comes to mysql things and Im not to sure what he means by " just escape the input before putting it in the db...

is this inserted into the database or the script If I cant fix it I will see if sands is about and see if he can fix it or contact the people I bought the script from

Thanks for the info Iv contacted the people who I purchased the script from and have told them what you guys have told me

:1orglaugh:1orglaugh:thumbsup