Indie-Resource.com

Hey all... I've setup a private messaging system now. It works great, but it won't let me send any apostrophe's in the text. If I just enter the word:
I get this error:
How can I fix that?

Let's say you are POSTING the form to other page or even the same as the name: $_POST["message"]

Whenever you put that in your db just remember to escape first That prevents XSS (tutorial i used is in IR), and allows you to have single and double quotes without damaging the query

PS: You don't need the function i have, just use: htmlentities($_POST["message"], ENT_QUOTES);

Sounds like you are not escaping the string properly.

It's been a while, but I think mysql_real_escape_string fixes this:

http://php.net/manual/en/function.mysql ... string.php

vitinho444 wrote:Let's say you are POSTING the form to other page or even the same as the name: $_POST["message"]

Whenever you put that in your db just remember to escape first

Code: Select all

//XSS Security
	function Escape($t)
	{
		return htmlentities($t, ENT_QUOTES);
	}

That prevents XSS (tutorial i used is in IR), and allows you to have single and double quotes without damaging the query

PS: You don't need the function i have, just use: htmlentities($_POST["message"], ENT_QUOTES);

Worked perfect! Thank you!

OldRod wrote:Sounds like you are not escaping the string properly.

It's been a while, but I think mysql_real_escape_string fixes this:

http://php.net/manual/en/function.mysql ... string.php

Thanks, I'll read on that as well

Worked perfect! Thank you!

This is some inspiration for people to help... Wow i'm addicted to helping people.

vitinho444 wrote:

Worked perfect! Thank you!

This is some inspiration for people to help... Wow i'm addicted to helping people.

Yes... When someone asks something that I know? I'll be the first to help

And you both were fast at answering. YAY to you both.