Sql error when user enter apostroephy - help!

[grwd]

I have a PHP form that gathers user input which I store in a mySql table.
A textbox gathers request data and places it in the var $request.

I run the following query to store the entered data in the table:

//Insert variables into table of previously selected DB.
$query = mysql_query("INSERT INTO requests VALUES ( '$ind', '$new_customer_id', '$gender', '$last_name', '$first_name', '$full_name', '$company', '$street', '$suburb', '$city', '$state', '$zipcode', '$country', '$email_address', '$full_phone', '$request_date', '$subject', '$request', '$please_respond', '$request_date', '$request_status', '$date_finished')");

Problem:
When a user enters a word with an aphostrophy like I'm or can't it throws an error:
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'm here!', 'Yes', '2005-05-07', '', '')' at line 1"

QUESTIONS:
What must I do in order to capture WHATEVER the user types into that textbox?

 

[r937]

you need to escape the apostrophe

i don't do php but i know there are functions which you can use to escape apostrophes

you might want to ask in the php forum

as far as the database is concerned, what you want is to replace each single apostrophe with two of them in a row, like this --

insert
  into sometable
     ( surname )
values
     ( 'O''Toole' )

mysql offers seveal other syntaxes for escaping characters, but the above will work in any database, as it's the standard sql way of doing it

rudy | r937.com | Ask the Expert | Premium SQL Articles
SQL for Database-Driven Web Sites (next course starts May 8 2005)

 

[fredericofonseca]

single quotes are a common problem.

If you really need to have your SQL like that then I suggest you create a function that replaces all single quotes within EACH field by two single quotes.
This still leaves you subject to SQL Injection, so I suggest you search these forums for "SQL injection" and see if you can change to use a method less prone to that.



Regards

Frederico Fonseca
SysSoft Integrated Ltd

http://www.syssoft-int.com