Query works except when variable has apostrophe in it

[ArizonaJohn]

Hello,

The query below works if $find is just a regular word with no special characters, and it even works if $find has a "%" in it or a "&".

However, it does not work if $find has an apostrophe in it. Any ideas on how I can change the code to make it work if $find has an apostrophe in it?

Thanks in advance,

John

<?
 
$find1 = urlencode($find); 
print     "<form action='process.php?find=$find1' method='post'>
        Add site: <input name='site' type='text' size='50'>
        <input type='submit' value='Submit'>
        </form> ";
?>

Then, on process.php, I have:

<?
 
$remove_array = array('http://www.', 'http://', 'www.');
$site = str_replace($remove_array, "", $_POST['site']);
mysql_connect("mysqlv10", "username", "password") or die(mysql_error());
mysql_select_db("database") or die(mysql_error());
 
$_GET['find'] = $find;
$_GET['find'] = stripslashes($_GET['find']);
$find = urldecode($find);
 
mysql_query("INSERT INTO `$find` VALUES (NULL, '$site',1,0)");
 
 
?>

[Markus]

First of all, you are wide open to SQL Injection. Please read up on this to prevent any malicious attacks on your database.

Your problem is directly related to the above, and the article can explain it better than myself.

Check out PDO library (specifically, prepared statements), and mysql_real_esca pe_string().