Trouble escaping / Misc nightmare

[Ian Rastall]

Sorry for the double question. I'm having a terrible time figuring out
how to escape apostrophes in my mySQL database. Perhaps they have to
be escaped in the PHP, using mysql_real_esca pe_string?

This is the code:

http://www.gongfamily.net/code.txt

The page in question is:

http://www.gongfamily.net/daevid.php

the entry being N'existe Pas. Information about the album should show
up on the left when the title is clicked on, but it doesn't happen
whenever there's an apostrophe. This is an escaping problem, I'm sure,
but the real problem is, I'm over my head!

The second problem is on the same page. You can click a table header
to sort the table, but when I click the 'Group' header, I get the
error:

"You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near 'Group ASC' at line 1"

But I'm lost as to what to do here. I've poured over the code, despite
not being very well-versed in PHP. Again, I'm over my head, and would
truly appreciate any help.

TIA

Ian
--
Was it not a comedy, a strange and stupid
matter, this repetition, this running around
in a fateful circle? (Hermann Hesse)
http://www.bookstacks.org/

[saint exupery]

'Group' is an invalid name for a column! (mysql get confused with the
"GROUP BY" clause).

[Ian Rastall]

On 28 Jun 2005 12:32:57 -0700, "saint exupery"
<cr************ ***@gmail.com> wrote:

'Group' is an invalid name for a column! (mysql get confused with the
"GROUP BY" clause).

LOL. Thank you so much. That would probably not have occurred to me in
a hundred years! :-)

Ian
--
Was it not a comedy, a strange and stupid
matter, this repetition, this running around
in a fateful circle? (Hermann Hesse)
http://www.bookstacks.org/

[Malcolm Dew-Jones]

Ian Rastall (id*******@gmai l.com) wrote:
: On 28 Jun 2005 12:32:57 -0700, "saint exupery"
: <cr************ ***@gmail.com> wrote:

: >'Group' is an invalid name for a column! (mysql get confused with the
: >"GROUP BY" clause).

: LOL. Thank you so much. That would probably not have occurred to me in
: a hundred years! :-)

Apparently mysql can escape keywords using `keyword`.

However, avoiding keywords is the best bet. (I like things like
the_group )
--

This space not for rent.

[Ian Rastall]

On 28 Jun 2005 12:54:41 -0800, yf***@vtn1.vict oria.tc.ca (Malcolm
Dew-Jones) wrote:

However, avoiding keywords is the best bet. (I like things like
the_group )

I just changed it to "Band". Same difference. :-) What I'm still
having trouble with, though, is figuring out how to escape my
apostrophes. It must just be one line of code in my HTML somewhere,
but I'm not sure where to put it.

The apostrophe problem only seems to happen with album names, since
those are the ones you click on. It takes whatever the name is, tries
to grab that from the db, and can't, because ... not sure, but I think
it's because the apostrophe is interpreted as a command of some sort.

Ian
--
Was it not a comedy, a strange and stupid
matter, this repetition, this running around
in a fateful circle? (Hermann Hesse)
http://www.bookstacks.org/

[Malcolm Dew-Jones]

Ian Rastall (id*******@gmai l.com) wrote:
: On 28 Jun 2005 12:54:41 -0800, yf***@vtn1.vict oria.tc.ca (Malcolm
: Dew-Jones) wrote:

: >However, avoiding keywords is the best bet. (I like things like
: >the_group )

: I just changed it to "Band". Same difference. :-) What I'm still
: having trouble with, though, is figuring out how to escape my
: apostrophes. It must just be one line of code in my HTML somewhere,
: but I'm not sure where to put it.

: The apostrophe problem only seems to happen with album names, since
: those are the ones you click on. It takes whatever the name is, tries
: to grab that from the db, and can't, because ... not sure, but I think
: it's because the apostrophe is interpreted as a command of some sort.

E.g.

$id = mysql_escape_st ring($_REQUEST[id]);

$sql = "select * from the_table where ID='$id'";
Always escape your values before stuffing them into the sql string, (not
just when you think you might need it).
--

This space not for rent.

[Ian Rastall]

On 28 Jun 2005 13:37:06 -0800, yf***@vtn1.vict oria.tc.ca (Malcolm
Dew-Jones) wrote:

$id = mysql_escape_st ring($_REQUEST[id]);

$sql = "select * from the_table where ID='$id'";

Okay, I think I'm making progress. I changed:

<td><a href="<?php print
$_SERVER['PHP_SELF']."?album=".$row _rsDaevid['Album'];
?>">

to

<td><a href="<?php print
$_SERVER['PHP_SELF']."?album=".mysq l_escape_string ($row_rsDaevid['Album']);
?>">

which yields an escaped string in the final source code. The page
still doesn't work, though, meaning clicking on the album doesn't pop
up the info on the left. I think it's looking for "N\'existe Pas" in
the db and not finding it.

I looked up the PHP equivalent of "unescape", and found "urldecode" ,
which I tried to use at the point where it calls the album, at:

<h3><?php echo urldecode($row_ rsDaevid['Album']); ?></h3>

but it didn't help. Didn't throw an error, either, but didn't help.
:-)

Am I on the right track here? Thanks for any help. The code, again, is
at:

http://www.gongfamily.net/code.txt

TIA

Ian
--
Was it not a comedy, a strange and stupid
matter, this repetition, this running around
in a fateful circle? (Hermann Hesse)
http://www.bookstacks.org/

[Ken Robinson]

Malcolm Dew-Jones wrote:

$id = mysql_escape_st ring($_REQUEST[id]);

$sql = "select * from the_table where ID='$id'";
Always escape your values before stuffing them into the sql string, (not
just when you think you might need it).

You can also use urlencode($var) or htmlentities($v ar,ENT_QUOTES)
before inserting $var into your database.

Ken

[Malcolm Dew-Jones]

Ken Robinson (ke******@rbnsn .com) wrote:
: Malcolm Dew-Jones wrote:
: > $id = mysql_escape_st ring($_REQUEST[id]);
: >
: > $sql = "select * from the_table where ID='$id'";
: >
: >
: > Always escape your values before stuffing them into the sql string, (not
: > just when you think you might need it).

: You can also use urlencode($var) or htmlentities($v ar,ENT_QUOTES)
: before inserting $var into your database.

You can, but you should still use mysql_escape_st ring on the result when
you embed it in an sql query being handled by mysql.
--

This space not for rent.

[Ken Robinson]

Malcolm Dew-Jones wrote:

Ken Robinson (ke******@rbnsn .com) wrote:
: You can also use urlencode($var) or htmlentities($v ar,ENT_QUOTES)
: before inserting $var into your database.

You can, but you should still use mysql_escape_st ring on the result when
you embed it in an sql query being handled by mysql.

You learn something new all the time. We you retrieve a string that
was stored this way, does MySQL unescape it or is there a function to
do it?

Ken