I'm inserting some data into a database from a form. I'm using addslashes
to escape the text (have also tried mysql_real_escape_string
with the same result).
Regular quotes are escaped, but some other quotes are not. For example, the string:
Homer's blood becomes the secret ingredient in Moe’s new beer.
is converted to:
Homer\'s blood becomes the secret ingredient in Moe’s new beer.
I didn't think the curly quote would matter unescaped, but only this text is inserted into the database:
Homer's blood becomes the secret ingredient in Moe
So PHP thinks the curly quote is fine, but MySQL is losing the string. MySQL is not giving any errors though.
I would look for a mismatch between the character encoding used in your Web interface and that used at the database level. If your Web interface uses UTF-8, for example, and your database is using the default MySQL encoding of latin1
, then you need to set up your tables with DEFAULT CHARSET=utf8
.
Use mysql_real_escape_string()
or mysqli, by the way. addslashes()
is NOT adequate protection against SQL injection.