Possible Duplicate:
Best way to stop SQL Injection in PHP
I am trying to insert ' sign and " in a mysql table using php. But the content has this two signs I get a mysql error.
$comment="I like '''' it so ""much"" Jaan";
mysql_query("INSERT INTO `comments` (`id` ,`name` ,`date` ,`comment`) VALUES ('', '$name', '$date', '$comment')");
above one is an example. Whenever an user insert ' or " in his comment the problem begins. I know about mysql_real_escape_string() but i dont want to use this. Bcz My comments are already filtered. Please tell me how I can Insert comment with those syntax. every suggestions are welcome.
Escape every string variable with mysql_real_escape_string()
.
精彩评论