How should I format my string before inserting it into a mysql table?

Question

So I'm creating this app for storing films about details and everything was working until I changed my OS from Mac to Ubuntu.

The user posts details about the film and the PHP script inserts it into the table; so, on a very basic level:

$description = $_POST['description'];

mysql_query("insert into film (description) values ('$description')");

Edit: Sometimes it works and sometimes it doesn't - I'm assuming it has something to do with the quotes and the variable (the film description that I'm entering) I'm inserting. The description of the description column is text. It works when I enter something random with no punctuation.

Edit: Entering real data for example this description of Monsters Inc. In a city of monsters with no humans called Monstropolis centers around Monsters, Inc., the city's power company. Monsters, Inc. The lovable confidant, tough large, furry blue behemoth-like giant monster named James P. Sullivan (A.K.A. better known as Sulley) and his Cyclops wisecracking best friend short, green monster with one large eye, Mike Wazowski discover what happens when the real world interacts with theirs in the form of a 2-year-old baby girl dubbed "Boo," who accidentally sneaks into the monster world with Sulley one night. And now it's up to Sulley and Mike to send Boo back in her door before anybody and especially two evil villains such as Sulley's main rival as a scarer chameleon-like Randall(a monster that Boo is very afraid of), who possesses the ability to change the color of his skin and Mike and Sulley's boss Mr. Waternoose the chairman and chief executive officer of Monsters, Inc

Doesn't work but I'm not sure what is 'breaking' it - i.e. is it the double quotes or parenthesis.

Is it giving any error? If you are not logging errors then you should start - occasionally error messages contain useful information. — jisaacstone
– jisaacstone, Commented May 29, 2011 at 18:21

Matty · Accepted Answer · 2011-05-29 18:06:59Z

2

Are the strings within bounds? For example, if you have a varchar(25) field and your string is 124 characters, you've got a problem. Also, check the encoding of the string. Validate your input.

Next, sanitize using mysqli_real_escape_string(). All input is evil and you've opened your app up to a SQL injection attack.

answered May 29, 2011 at 18:06

Matty

34.9k14 gold badges69 silver badges94 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

zsalzbank · Accepted Answer · 2011-05-29 18:03:33Z

2

You should take a look at mysql_real_escape_string.

Basically - you need to make sure your string does not have any characters in it that can mess up the SQL query.

answered May 29, 2011 at 18:03

zsalzbank

9,8611 gold badge28 silver badges39 bronze badges

Collectives™ on Stack Overflow

How should I format my string before inserting it into a mysql table?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related