commentform - encode characters before submission to db

Hi, I keep getting a SQL insert statement error when a comment field contains certain characters like an apostrophe (’) or a question mark. Is there a way to encode the string before it gets processed by MySQL?

Any help is greatly appreciated.

Hi Marschants,

You can use addslashes() before placing the value into the database. So, syntax would be: addslashes($mycomment)

And then use stripslashes($mycomment) when you retrieve the value.

Hope that helps, Garry

Thanks for the speedy reply Garry, I’m using the commentform snippet to handle all the posting but will take a look at modifying it to do that.

Even better might be mysql_escape_string(), or mysql_real_escape_string()

http://il.php.net/manual/en/function.mysql-real-escape-string.php

Or use the modx escape function: http://modxcms.com/dbapi-escape.html

the modx wrapper function uses mysql_escape_string, which is deprecated. However, depending on your version of php, mysql_real_escape_string may not be available.

let’s just imagine I’m a total newbie at all this - how do I add this to my comments form so people can use punctuation in their comments and is this going to be patched soon?

the DBAPI in the latest 0.9.2x release has the escape() function modified to use mysql_real_escape_string() if available, and mysql_escape_string() if not.