PHP SQL Server Removing Single Quotes from user entered data [duplicate]

Question

I have a PHP form where users can enter data. When they do, they use special characters like single quotes.

This prevents their data from being put into the SQL table. I am NOT using MySQL. I am using SQL Server.

How can I fix this?

My code is:

include'dbcon.php';
//connectiontothedatabase
$dbhandle=mssql_connect($myServer,$myUser,$myPass)
or die("Couldn't connect to SQL Server");
//selectadatabasetoworkwith
$selected=mssql_select_db($myDB,$dbhandle)
or die("Couldn't open database");
session_start();
$surnum=$_SESSION['surnum'];
$email=$_SESSION['email'];
$site=$_SESSION['site'];

$query="INSERT INTO ZSURVEYA(SURNUM_0,EMAIL_0,A_0,A_1,A_2,A_3,A_4,A_5,A_6,A_7,A_8,A_9,A_10,A_11,A_12,A_13) VALUES ('$surnum','$email',convert(varchar(max),'$_POST[Q_0]'),convert(varchar(max),'$_POST[Q_1]'),convert(varchar(max),'$_POST[Q_2]'),convert(varchar(max),'$_POST[Q_3]'),convert(varchar(max),'$_POST[Q_4]'),convert(varchar(max),'$_POST[Q_5]'),convert(varchar(max),'$_POST[Q_6]'),convert(varchar(max),'$_POST[Q_7]'),convert(varchar(max),'$_POST[Q_8]'),convert(varchar(max),'$_POST[Q_9]'),convert(varchar(max),'$_POST[Q_10]'),convert(varchar(max),'$_POST[Q_11]'),convert(varchar(max),'$_POST[Q_12]'),convert(varchar(max),'$_POST[Q_13]'))";

mssql_query($query);

coding style guides (pls tell me if the link is inappropriate) — Daniel W.
– Daniel W., Commented May 20, 2014 at 20:54

GGio · Accepted Answer · 2014-05-20 20:51:07Z

1

To answer your question use addslashes() function BUT DO NOT USE IT here is why:

You are not sanitizing your data before using it directly into SQL
You should never put a variable value directly into SQL (look up SQL Injection)
You SHOULD use prepared statements, I am sure PDO supports SQL so I would look up PDO at php.net/pdo

answered May 20, 2014 at 20:51

GGio

7,67311 gold badges48 silver badges85 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

James Anderson Over a year ago

Neither the "duplicate original answer" was helpful, nor addslashes. Neither worked. :/ Nothing so far is proving to solve the issue.

Collectives™ on Stack Overflow

PHP SQL Server Removing Single Quotes from user entered data [duplicate]

1 Answer 1

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Linked

Related