Special Characters Insert To MySQL

Question

Hello I am trying to get special characters to insert into MySQL, as I can't use them.

This what I got so far...

   mysql_query("UPDATE profiles SET .mysql_real_escape_string playground='$_POST[playground]' WHERE
     username='$_SESSION[membersusername]'");

The text form is

<form method="POST" action="playground.php?action=edit">


            <table width="100%" border="0" align="center">
  <tr>
    <td width="341">Playground<br><textarea name="playground" id="maxLength" rows="5" cols="50"><? echo $playground ?></textarea></td>
  </tr>
  <tr>
    <td><input type="submit" name="submit" value="Update" /></td>
  </tr>
          </table>

  </form>

Hopefully someone will help.

And thats why you use prepared statements,but more to the point that is wrong syntax.`UPDATE TABLE SET COLUMN...` — Mihai, Feb 23 '14 at 21:44

score 0 · Answer 1 · answered Feb 23 '14 at 21:47

try using this

 $playground = mysql_real_escape_string($_POST[playground]) ;
 mysql_query("UPDATE profiles SET  playground='$playground' 
              WHERE username='".$_SESSION['membersusername']."' ");

change that line

 <td width="341">Playground<br><textarea name="playground" id="maxLength" rows="5" cols="50"><? echo $playground ?></textarea></td>

to

  <td width="341">Playground<br><textarea name="playground" id="maxLength" rows="5" cols="50"></textarea></td>

That worked thanks guys! I know I am trying to get iMySQL on server. — MBell86, Feb 23 '14 at 21:53

score 0 · Answer 2 · edited May 23 '17 at 12:20

0

You have a syntax error in your query, so change as follow

mysql_query("UPDATE profiles SET playground='".mysql_real_escape_string($_POST['playground'])."' WHERE   username='".$_SESSION['membersusername']."'");

As side note i would tell you to use prepared statements with either PDO or mysqli, your code is infact highly vulnerable to mysql injections, learn more here

edited May 23 '17 at 12:20

Community

1
1

answered Feb 23 '14 at 21:47

Fabio

21,516
12
49
63

score 0 · Answer 3 · answered Feb 23 '14 at 21:47

Query is not correct and it should be

mysql_query("UPDATE profiles 
SET  playground='".mysql_real_escape_string($_POST[playground])."' 
WHERE
username='".$_SESSION[membersusername]."'");

How ever you should stop using mysql_* functions since they are deprecated and start using mysqli_* functions or PDO with prepare statement.

Special Characters Insert To MySQL

3 Answers3