PHP MySQL insert

[benrob82]

I've read a number of threads to try and solve this problem, I have a query string link the one below

$insert = "insert into accounts values ('$accountid',NOW(),'','','','website','$company_name','','Student: Student/Graduate Member','','$turnover','$tel3','$home_address1 $home_address2','$home_city','$home_county','$home_postcode','United Kingdom','$statement','','$tel4','','$email','','$website','','$employees','','','$term_address1 $term_address2','$term_city','$term_county','$term_postcode','United Kingdom','0')";

and if there are any single quotes or apostrophes ' the database does not update.

I dont seem to be able to find a solution for this. Can anyone help with a definitive answer?

Thanks

 

[pwesson]

Do you have a typo in your example, because you have not end quote and comma after $home_address1. Also check your date definitions... you don't need quotes around numeric fields... ie $accountid or the zero at the end.

Paul Wesson, Programmer/Analyst

http://www.ipaw.net

 

[jpadie]

you need to escape values before inserting them into databases.

<?
$insert = "
		insert 
			into accounts 
		values (
		'".mysql_escape_string($accountid)."',
		NOW(),
		'',
		'',
		'',
		'website',
		'".mysql_escape_string($company_name)."',
		'',
		'".mysql_escape_string("Student: Student/Graduate Member")."',
		'',
		'".mysql_escape_string($turnover)."',
		'".mysql_escape_string($tel3)."',
		'" mysql_escape_string($home_address1 . " " . $home_address2)."',
		'".mysql_escape_string($home_city)."',
		'".mysql_escape_string($home_county)."',
		'".mysql_escape_string($home_postcode)."',
		'United Kingdom',
	'".mysql_escape_string($statement)."',
	'',
	'".mysql_escape_string($tel4)."',
	'',
	'".mysql_escape_string($email)."',
	'',
	'".mysql_escape_string($website)."',
	'',
	'".mysql_escape_string($employees)."',
	'',
	'',
	'".mysql_escape_string($term_address1 ." ".$term_address2)."',
	'".mysql_escape_string($term_city)."',
	'".mysql_escape_string($term_county)."',
	'".mysql_escape_string($term_postcode)."',
	'United Kingdom',
	'0')";
	?>