Mysql insert query?

PHP
1

how to insert ’ " in my sql query which thing i use in query that can ignore these sign for inserting in databse
for example

if my query is like this

"INSERT into songs (mname,sname,link,size,date) VALUES ('$mname','$sname','$link','$filesize','$date')";

and
$sname= i don’t like

$name value don’t insert in column becoz if ’ or " in variable
how to avoid this type of things and insert it in database without error

2

[FPHP]mysql_real_escape_string[/FPHP]

3

Are you asking a question, or making a statement here?

4

of course asking question

5

mysql real escape function is escaping ’ " these things from query my variable but i need these thing in my query that i can insert the same name which is in my variable
if my variable is
$variable = Hello I don’t like
it enter in database same Hello I don’t like
not like idont like

what i use here

6

real escape string should enter it into the database as “Hello I don\'t like”. You then stripslashes the text when it comes out.

7

thanks

8

You don’t have to stripslashes on the way out. The escape is not stored in the db as a character. Be sure you escape each variable individually before composing your SQL string. Will also prevent SQL injection. (good habit)

9

Do not store strings such as Hello I don\'t like into the database. Adding and removing slashes can be a PITA; sooner or later you would end up displaying Hello I don\\\\\'t like on your website. Do this instead:

$query = sprintf("INSERT INTO songs(mname, sname, link, size, date)
	VALUES ('%s','%s','%s','%s','%s')",
	mysql_real_escape_string($mname),
	mysql_real_escape_string($sname),
	mysql_real_escape_string($link),
	mysql_real_escape_string($filesize),
	mysql_real_escape_string($date)
);
10

well this one also adding slashes before ’ ya " mean for out every query i have use stripslashes ? is this necessery

11

No. They were right, my brain had a fart. Addslashes was the old way of escaping strings.

Real Escape String should just plop the data into the database as it is when it came in. Retrieving it should be just a straightforward query and output.

12

yaa he was right
i have some mistake the IDEA is Good (y)
ThaNKS

13

well one more question if we are using sprintf then why we are using mysql real escape?
for making query more secure ?