|
PHP - Insert Single Quotes From Text Area
Hello all.
I have a textarea on a form that users are posting new's stories into. Most are just copy/pasteing from Word, and they need to be able to include single quotes. (ie: John's favorite store is Micky's) I can't figure out how to make the single quotes (') into double quotes ('') so MSSQL will insert them in. Any help? Here's my process code: <?php $title = $_POST['title']; $district = $_POST['district']; $central = $_POST['central']; $east = $_POST['east']; $north = $_POST['north']; $west = $_POST['west']; $story = $_POST['story']; $date = date("l, M j, Y"); $sqlpicturename = "$picturename.jpg"; $showpicture = $_POST['showpicture']; //declare the SQL statement that will query the database $query = " INSERT INTO News (district, central, east, north, west, date, title, story, picture, showpicture, show) Values ('$district' , '$central', '$east' , '$north', '$west' , '$date', '$title' , '$story', '$sqlpicturename' , '$showpicture' , 'true') "; //execute the SQL query and return records $result = mssql_query($query); //display the results echo "Thank You For Posting Your Story:<b> $title </b><br /><br /><a href='addstory.php'>Click Here To Add Another Story</a><br /><br /><a href='index.php'>Click Here To Go Back To The WebEdit Menu</a>"; echo "<br /><br />"; mssql_close(); ?> Similar TutorialsThis code only works in firefox <a onMouseout='hidetooltip()' onMouseover='tooltip(\"<img src=img/heroes/$hero.gif\")' href='hero.php?hero=$hero'>Text</a> Btw, I use this in echo (php). How to get quotes (triple) on <img src= ? I also have tried <img src='img/heroes/$hero.gif' But only works on FireFox I have a paragraph in a text in my data table column with apostrophes and heights, like, "He'll likely grow beyond 6'6"."
I've tried addslashes($update), but it's not working. (At another time I thought I had something like that.) Is there something that will take care of it short of typing \ before every instance I use quotes, the using stripslash? Hello everyone! This is my first post. I am very new to php and mysql and coding in general. It has not been made 100% clear to me as to when I should use single quotes, double quotes, and {}. From what I gather you use single quotes for literal interpretation... so if you put something like a variable in single quotes and echoed it, it would literally echo it as it is written and not the value of the variable. in double quotes, I gather that it will echo the value of the variable. as for {} I am unclear as to when to use the curly brackets for a variable. I am assuming if you had a statement in single quotes and you put a variable in curly brackets you would get the value of the variable?
Edited by LazerOrca, 25 November 2014 - 11:20 PM. I don't think I've asked this before have I?? can someone give me an internet KB that gives me all scenarios that warrant using singles or doubles? as in, wrapping values, variables, and why I need to do either, and when, etc, etc....? thanks Edited March 29 by ajetrumpetGreetings, I'm trying to execute a shell command with a user-supplied password as input. The password may contain apostrophes and and virtually any other character. Unfortunately, when using escapeshellarg(), the password argument is interpreted as two separate arguments, as escapeshellarg() will handle apostrophes (single quotes) by breaking out of the already quoted text and using a backslash escape. $password = escapeshellarg("ex'ample!%"); // The password will actually be supplied by an HTML form. $command = ('echo '.$password); echo "$command"; // Returns 'ex'\''ample!%' Does anyone have any input on how to accomplish what I'm trying to do? I'd like to allow obscure passwords without disallowing specific characters, while still being "safe" in passing the information to a shell command. Double quotes would work for passing single quotes, but I'm afraid I might break other characters there. Thanks. I have a simple form that connects to this php page. Only two variables, "ArticleDescription" & "URL". I've tried a number of things, several of which are listed below, but have had no success. I'm certain it's just my idiocy but am requesting some help with this. I KNOW it's an easy fix, it's just over my head, I'm only four days into programming, so I'm a complete newb. Your kindness is requested. ---- <?php // connection mysql_select_db("doofyd5_comments", $con); $ArticleDescription=mb_convert_encoding($ArticleDescription, 'UTF-8', 'UTF-8'); $URL=htmlspecialchars($URL, ENT_QUOTES); $ArticleDescription=str_replace('\"','"',$ArticleDescription); $sql="INSERT INTO web_articles (ArticleDescription, URL) VALUES ('$_POST[ArticleDescription]','$_POST[URL]')"; if (mysql_query($sql,$con)) { header ("location:desiredurl"); require_once('desiredurl"); exit(); } else { echo "You may have added a single quote to the article description!"; } mysql_close($con) ?> ---- for print html : What's Better, Faster and Optimized ?!? Code: [Select] echo "<tr height=\"22\"> <form action = \"{$URL}/admin/edit.php\" method=\"POST\"> <input type=\"hidden\" name=\"login\"> <td width=\"15%\" bgcolor=\"$bgcolor\"> <input type = \"text\" name = \"login\" value=" . $f['login'] . "></td> <td width=\"15%\" bgcolor=\"$bgcolor\"> <input type = \"password\" name = \"password\" value=" . $f['pass'] . "> </td> </form> </tr>"; With PHP Method 2 : ( single ) Code: [Select] echo ' <tr><form action = "' . URL . '/admin/editadmins.php" method="POST"> '; echo ' <td align="left" valign="top"><input type = "text" name = "login" value = "' . $f['login'] . '"></td>'; echo ' <td align="left" valign="top"><input type = "password" name = "password" value = "' . $f['pass'] . '"></td></form></tr>'; Method 3 : (With Html And Php echo ) Code: [Select] <tr height="22"> <form action = "../admin/editadmins.php" method="POST"> <td align="left" valign="top"><input type = "text" name = "login" value = "<?PHP echo $f['login']; ?>"></td> <td align="left" valign="top"><input type = "text" name = "password" value = "<?PHP echo $f['pass']; ?>"></td> </form> <tr> Thanks. I'm using the codeigniter mvc framework and there's an escape function to use before adding the data to the database. This function adds single quotes around the string of data. Is there any already existing php function or does anyone know how to code a function that strips ONLY the surrounding single quotes? I'm not sure if this is an HTML or browser issue... But single quotes in strings from database don't work for me in Chrome for some reason. To mine or any other computers. Every other browser detects these quotes. I'm outputting an SQL result containing strings like: Texas Hold'em or America's Cup and I get Texas Hold America Is there a difference between a single quote regex and and double quote regex ?
for example :
<?php
$res1 = preg_match('/shi*t/', $comment);
$res2 = preg_match("/shi*t/", $comment);
?>
Thank you
Edited by Dareros, 17 September 2014 - 07:07 PM. how do i handle single quotes in sql query Code: [Select] " SELECT name from phrase WHERE name='$stitle' ";this returns an error because the name contains single quotes like this: Johnson's. When I add a ' or " quotes in a textarea I get a sql error when it tries to insert the record.
I was told to use mysqli_real_escape_string but that didn't work.
Here's my code -
$blog= mysqli_real_escape_string($con, $_POST['blog']);
$blog= $_POST['message'];
$sql = "SELECT * FROM table WHERE `message` = '{$message}'";
$result = mysql_query($sql);
if ( mysql_num_rows ( $result ) > 0 )
{
$error = "Message Exists.";
}
else
{
$error = "This message does not exist. Insert it!!!";
$sql="INSERT INTO table (message) VALUES ('$_POST[message])";
}
if (!mysqli_query($con,$sql))
{
die('Error: ' . mysqli_error($con));
}
mysqli_close($con)
Edited by barkly, 26 October 2014 - 09:31 PM. hello; my webhost made a change to my php.ini file yesterday. since then php is escaping single quotes that it receives from flash. Code: [Select] //-- AS3 var myVariables:URLVariables = new URLVariables(); myVariables.pvs_params = "'h'e'l'l'o" ; var myURLRequest:URLRequest = new URLRequest("mysql_task_mgr.php"); myURLRequest.data = myVariables ; myURLRequest.method = "get" ; navigateToURL( myURLRequest, '_blank' ) ; Code: [Select] //-- php print( $_GET[ "pvs_params" ] ) ; // --> \'h\'e\'l\'l\'o any thoughts? my webhost is stumped; I have a navigation list displaying which is a mix of html and php, everything is working fine however now I want to convert this block of code into a function but am having major problems with quotes. The line of code I currently have is
$data = $db->query("SELECT * FROM menu")->fetchAll(PDO::FETCH_ASSOC);
foreach ($data as $row) { ?>
<li><a href="<?php echo $row['url']; ?>" title="<?php echo $row['title']; ?>"><?php echo $row['icon'] . ' ' . $row['header']; ?></a></li>
<?php
}
?>
As I say everything works using the above but now I am trying to echo the full li out and am having major issues with single and double quotes. I currently have echo "<li><a href='#' title='the title'><i class='fas fa-user site-nav--icon'></i> Help</a></li>"; Now I am trying to use the $row['url'], $row['title'], $row['icon'] & $row['header'] as per the top example but I cannot get the combination of quote marks correct, whether to use double, single or a combination. I would be grateful if someone could suggest the correct syntax for the a tag then I can work through the rest. Thanks Hi all, I use a MySQL insert query of the following form: Code: [Select] <?php $insert1= mysql_query ("INSERT INTO tablename (H1, H2, H3) VALUES '$V1','$V2','$V3')"); ?> However, I encounter problems when $V1, $V2 or $V3 contain certain symbols, such as quotes ("'). What is the best way to avoid this? Thanks! I am trying to insert data from a mysql in a table. I want the data to appear with the image on the left, item name on the top right followed by description underneath. <?php $sql = 'SELECT * FROM tbl_products ORDER BY id'; $result = $db->query($sql); $output[] = '<ul>'; $output[] = '<table border="3" bordercolor="#000000">'; while ($row = $result->fetch()) { $output[] = '<tr>'; $output[] = '<td><img src="images/'.$row['pic'].'" width="67" height="100" /></td>'; $output[] = '<td class="style10"><strong>'.$row['item_name'].'</strong></td>'; $output[] = '<td>'.$row['item_description'].'</td>'; $output[] = '</tr>'; } $output[] = '</table>'; echo join('',$output); ?> I would like the items to appear the same way as this page http://aafcollection.info/items/list.php For instance if i set the following 2x variables; "$varOne = $_GET[first_name]" "$varTwo = $_GET[last_name]" "$varThree = $_GET[userid]" how do i insert them both together into a DB field for example: $full = $varOne,$varTwo,$varThree (without the , ) this would then be echo as : joebloggs66985 i have the INSERT in there atm but i wanted to insert first name and last name together with there userid to generate a sort of username possibility. sorry if i didnt explain correcly I'd like to use a text editor like this one: http://tinymce.moxiecode.com/examples/full.php for my forums. But I am not sure exactly how I would prevent abuse and injects to messed up the page, rather than being contained in the designated area it is meant for. Could some one please help me, I know htmlspecailchars will not work, since some of the code needs to render as html Quotation marks are confusing me.
What do you guys use when it comes to quotation marks?
In HTML attributes and throughout the bodies of my web pages, I use the HTML entity ("). For example:
<a href="" title="Read "Article Name""> <p>In his new book, he says: "This is a quote."</p>I thought that this is the best practice. However, today, I read that it's perfectly safe to use straight quotes (") in the body, and that I should use the HTML entity only in HTML attributes. Is that correct? But what if I want to use curly quotes in the body instead of straight quotes? Should I always use the HTML entities for curly quotes (“ and ”), or can I also safely use the characters (“”)? I heard that straight quotes are safe in all browsers, even if you don't specify the character set of your web pages, but that curly quotes are only safe if you specify the character set or if you use the HTML entities. Is that true? And what about the <q> tag? Apparently, it's compatible with all browsers but they treat it differently. Edited by Fluoresce, 30 August 2014 - 07:37 AM. I’m trying to construct a button that simply writes an "aleph" character into a text area, see below.
My code does not work, can anyone tell me why ? How should I fix it ?
<!DOCTYPE html>
<html>
<meta charset="UTF-8">
<head>
<title>Example</title>
<script type="text/javascript">
//JavaScript code goes here
function insertAtEnd(text)
{
var theArea = document.getElementById("thisArea");
theArea.value += '' + text + '';;
}
</script>
</head>
<body>
<input type="button" id="aleph" name="aleph" value="Write an aleph"
onClick="javascript:insertAtEnd(\'<span>א</span>\');return(false)" />
<textarea id="thisArea"> </textarea>
</body>
</html>
|
|||||||