PHP - Double Quotes Performance

I'm designing a website that takes user input from in a <textarea></textarea> and enters the input into a database. Everything works besides if the user has double quotes (") in his/her message. (the name of the table that I want to add to is alluserposts)

What i have so far is the following:
from index.php:
<form action="insert2.php" method="post"><textarea name="user_post" rows="6" cols="35"></textarea></form>

from insert2.php:
mysql_query("INSERT INTO alluserposts (post_value) VALUES(" . "\"" . $_POST['user_post'] . "\")" ,$db) or die(mysql_error($db));

I want the user to be able to input any character. How can i do that?

for print html : What's Better, Faster and Optimized ?!?

Code: [Select]
echo "<tr height=\"22\">
    <form action = \"{$URL}/admin/edit.php\" method=\"POST\">
      <input type=\"hidden\" name=\"login\">
      <td width=\"15%\" bgcolor=\"$bgcolor\">&nbsp;<input type = \"text\" name = \"login\" value=" . $f['login'] . "></td>
      <td width=\"15%\" bgcolor=\"$bgcolor\">&nbsp; <input type = \"password\" name = \"password\" value=" . $f['pass'] . "> </td>
    </form>
        </tr>";

With PHP Method 2 : ( single )

Code: [Select]
echo ' <tr><form action = "' . URL . '/admin/editadmins.php" method="POST"> ';
 echo ' <td align="left" valign="top"><input type = "text" name = "login" value = "' . $f['login'] . '"></td>';
 echo ' <td align="left" valign="top"><input type = "password" name = "password" value = "' . $f['pass'] . '"></td></form></tr>';

Method 3 : (With Html And Php echo )

Code: [Select]
<tr height="22">
<form action = "../admin/editadmins.php" method="POST">
<td align="left" valign="top"><input type = "text" name = "login" value = "<?PHP echo $f['login']; ?>"></td>
<td align="left" valign="top"><input type = "text" name = "password" value = "<?PHP echo $f['pass']; ?>"></td>
</form>
<tr>
Thanks.

I have created a simple form that collects a comment or question from a visitor to my website.

The problem is that if the visitor types:
Your site looks Ok.
I will get that message.

But if the type: Your site needs "Work".
I will get: Your site needs

The script will not send the double quotes or anything after the double quotes

What am I missing???

I have tried:
addslashes()
str_replace()
preg_replace()

with on change to the message.



This is the script

Code: [Select]
<?php

$recipient = $_POST['recipient'];
$subject = $_POST['subject'];
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$senders_email_address = $_POST['senders_email_address'];
$comments = $_POST['comments'];

$mailheaders .= "To: Thin Dime Web. <$recipient>\n";
$mailheaders .= "From: $first_name $last_name <$senders_email_address>\n";



       $body .= "Subject: $subject\n\n";
       $body .= "Senders Name: $first_name $last_name\n";
       $body .= "E-mail Address: $senders_email_address\n\n";

       $body .= "The following Comments or Question came from a visitor to your website\n";
       $body .= "\n";
       $body .= "$comments\n";


       mail("$recipient", "$subject", "$body", "$mailheaders");

?>

Is there a difference between a single quote regex and and double quote regex ?   for example :

<?php
$res1 = preg_match('/shi*t/', $comment);
$res2 = preg_match("/shi*t/", $comment);
?>

Thank you
Edited by Dareros, 17 September 2014 - 07:07 PM.

When I add a ' or " quotes in a textarea I get a sql error when it tries to insert the record.    I was told to use mysqli_real_escape_string but that didn't work.    Here's my code -

   $blog= mysqli_real_escape_string($con, $_POST['blog']);
   

        $blog= $_POST['message'];
            
        $sql = "SELECT * FROM table WHERE `message` = '{$message}'";
        
        $result = mysql_query($sql);
        
        if ( mysql_num_rows ( $result ) > 0 )
        {
                        
            $error = "Message Exists.";
        }
        
        else
        {
        
         $error = "This message does not exist. Insert it!!!";
        
         $sql="INSERT INTO table (message) VALUES ('$_POST[message])";
        
        
        }
        
        if (!mysqli_query($con,$sql))
         {
         die('Error: ' . mysqli_error($con));
         }
        
        mysqli_close($con)

Edited by barkly, 26 October 2014 - 09:31 PM.

Hi all

I have a field in mySQL table called dimensions. It has the double quote in in for inches - "

When I echo the result from the mySQL query on the item page (Customer facing) it's fine. However, I have built a form so that the administrator can edit the dimensions in the admin panel and when I echo it out in to the form field it stops when it gets to the double quotes?

Pete

I have a navigation list displaying which is a mix of html and php, everything is working fine however now I want to convert this block of code into a function but am having major problems with quotes.

The line of code I currently have is 

$data = $db->query("SELECT * FROM menu")->fetchAll(PDO::FETCH_ASSOC);

foreach ($data as $row) { ?>
     <li><a href="<?php echo $row['url']; ?>" title="<?php echo $row['title']; ?>"><?php echo $row['icon'] . ' ' . $row['header']; ?></a></li>

<?php
	}
?>

As I say everything works using the above but now I am trying to echo the full li out and am having major issues with single and double quotes.

I currently have 

echo "<li><a href='#' title='the title'><i class='fas fa-user site-nav--icon'></i> Help</a></li>";

Now I am trying to use the $row['url'], $row['title'], $row['icon'] & $row['header'] as per the top example but I cannot get the combination of quote marks correct, whether to use double, single or a combination.

I would be grateful if someone could suggest the correct syntax for the a tag then I can work through the rest.

Thanks

Quotation marks are confusing me.   What do you guys use when it comes to quotation marks?   In HTML attributes and throughout the bodies of my web pages, I use the HTML entity (&quot;). For example:

<a href="" title="Read &quot;Article Name&quot;">

<p>In his new book, he says: &quot;This is a quote.&quot;</p>

I thought that this is the best practice.   However, today, I read that it's perfectly safe to use straight quotes (") in the body, and that I should use the HTML entity only in HTML attributes.   Is that correct?   But what if I want to use curly quotes in the body instead of straight quotes? Should I always use the HTML entities for curly quotes (&ldquo; and &rdquo;), or can I also safely use the characters (“”)?   I heard that straight quotes are safe in all browsers, even if you don't specify the character set of your web pages, but that curly quotes are only safe if you specify the character set or if you use the HTML entities.   Is that true?   And what about the <q> tag? Apparently, it's compatible with all browsers but they treat it differently.
Edited by Fluoresce, 30 August 2014 - 07:37 AM.

The fancy-looking quotes won't insert into my DB, so I'm trying to convert them to %93 & %94 or normal quotes.    Nothing I've tried works.   Code:   $fancy=" “test” ";
$fixed=htmlentities($old, ENT_QUOTES);   echo "fancy: $fancy<br>"; echo "fixed: $fixed";

Results:

fancy: “test”
fixed:   I want $fixed to be %93test%94, or even "test" would work. 
Edited by rwmaho, 18 October 2014 - 01:28 PM.

Im going to use a large array of arrays, each of one having a lot of values and some sub arrays. My question is...  is faster to use arrays or is better to have a object to acces using methods and all? i suppose objects are slower...

Also i was planing in use arrays with string keys in nearly all places, normally these are slower, but in php hashes and arrays are the same tipe  so i dont know...

Alright guys, I see people recommending prepared statements (PDO/MySQLi) and saying that they are way to go these days.

However upon doing a bit more research, I've found that prepared statements, PDO in particular, is lacking in terms of performance, especially using SELECT statements. 

Now I'm starting a new project, which is basically a text based game with lots of queries and DB interaction, so I'm really interested in knowing what's the best approach for me.  I was leaning towards PDO but I don't want it crawling my server under heavy load.

I appreciate any advices or first hand experiences on this.

I have the following simple code to test against collision on a primary key I am creating:

Code: [Select]
        $machine_ids = array();
for($i = 0; $i < 100000; $i++) {
//Generate machine id returns a 15 character alphanumeric string
                $mid = Functions::generate_machine_id();

if(in_array($mid, $machine_ids)) {
die("Collision!");
} else {
$machine_ids[] = $mid;
}
}

die("Success!");

Any idea why this is taking minutes to run? Anyway to speed it up?

I want to do a test while refreshing the page 100 times with 500 rows in a table, and then without 500 rows in a table and with different kind of php code, i need to do some type of testing to get results back in to show which way is faster for mysql/php.

Any idea how to do this any scripts out there or a built in php/mysql function?

Thanks