Problem with quotes

PHP
1

Hey
I’m trying to build a SQL query, but Aptana gives me in this line syntax error.
I know the problem is with the quotes, but I can’t fix it.


$query1 = "INSERT INTO clients (firstname, lastname, address) VALUES ('$_POST['firstname']', '$_POST['lastname']', '$_POST['address']')";
2

Yes,
thank you.

3

use extract($_POST) and use instead $address of $_POST[‘address’]

4 
$query1 = "INSERT INTO clients (firstname, lastname, address) VALUES ('".$_POST['firstname']."', '".$_POST['lastname']."', '".$_POST['address']."')";

I should mention you should sanitize your data before plugging it direclty into your table. Something like this:

function escape_data ($data) { 
	
	if (ini_get('magic_quotes_gpc')) {
		$data = stripslashes($data);
	}
	
	return mysql_real_escape_string (trim($data));
} 


$query1 = "INSERT INTO clients (firstname, lastname, address) VALUES ('".escape_data($_POST['firstname'])."'.....";
5

For future string manipulations in PHP, see http://php.net/manual/en/language.types.string.php this page once in the manual where you can see lots of examples to understand.

6

No, use jsbarra’s escape_data function and then


$address = escape_data($_POST['address']);
$firstname = escape_data($_POST['firstname']);
// etc

extract() is among the function I consider evil (when used for the wrong reasons, like extracting $_POST, which is kind of like using register_globals, and that is also evil).