mysqli_real_escape_string not working

Question

I just learned I had magic_quotes_gpc on (much to my chagrin). I turned that off.

My database connection is made prior to this query. I have the following:

$subject = mysqli_real_escape_string($link, $_POST["subject"]);
$body = mysqli_real_escape_string($link, $_POST["body"]);
$id = mysqli_real_escape_string($link, $_POST["id"]);


mysqli_query($link, "UPDATE press SET press_title = '$subject', press_release = '$body' WHERE press_id = '$id'") or die( mysqli_error($link) );

With magic quotes on, this works fine. Once I turn it off, single quotes jam up the works (with a MySQL syntax error at the quote). I thought I understood the concept but I must be missing something. Can someone explain what I'm doing wrong?

UPDATE

Error spit out by MySQL: you have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's what she said' at line 1

UPDATE #2 Here's the echo'd query:

UPDATE press SET press_title = \'That\'s what she said\', press_release = \'That\'s what she said again!\' WHERE press_id = \'513\'

Read about mysqli_prepare() and mysqli_stmt_bind_param() at php.net. — Barmar
– Barmar, Commented Nov 23, 2013 at 6:23

Barmar · Accepted Answer · 2016-12-08 22:53:29Z

1

Use a parametrized query:

$stmt = mysqli_prepare($link, "UPDATE press SET press_title = ?, press_release = ? WHERE press_id = ?") or die (mysqli_error($link)); 
mysqli_stmt_bind_param($stmt, "ssi", $_POST['subject'], $_POST['body'], $_POST['id']);
mysqli_stmt_execute($stmt);

Manual

edited Dec 8, 2016 at 22:53

answered Nov 23, 2013 at 6:28

Barmar

789k57 gold badges554 silver badges669 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Barmar Over a year ago

It specifies that the types of the parameters are string, string, and integer. Isn't that clear from the documentation?

Collectives™ on Stack Overflow

mysqli_real_escape_string not working

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related