PHP/SQL insert issue

[hadge26]

Hi guys, please excuse me as im a bit of a noob. I'm making a blog site where the user can use a control panel page to update their blogs / articles. Its all going ok but when i post either " or ' into the text field it doesnt make it in to the data base.

Can anyone help? heres my code:


[PHP]<? session_start();
$_SESSION['text'] = $text;


//Functions!
$ip = $_SERVER['REMOTE_ADDR'];
{


{
$sqlquery = "INSERT INTO article (title, body, poster, link, cat) VALUES ('$title', '$body', '$poster', '$link', '$cat')";
} {
/* $sqlquery = ""; */
}

$results = mysql_query($sqlquery);

mysql_close();

print "<span class='p2'><br><br>Record Updated<br><br>";
print "Catagory = $cat<br><br>";
print "title = $title<br><br>";
print "Body = $body<br><br>";
print "Source = $link<br><br>";
print "Posted By = $poster<br><br>";

}
?>[/PHP]


And the html form

[HTML]<form action="addarticle_1.php" method="post">
<tr class="para">
<td colspan="2"><div align="center"> <strong>Welcome to Add an Article!</strong><br />
Please fill in the form below to add a new article.</div>
<span>
<hr align="center" size="1" />
</span></td>
</tr>
<tr class="para">
<td align="right">title : </td>
<td width="300" align="left"><input type="text" name="title" class="input" size="80" maxlength="80" value="<? echo $_SESSION['title']; ?>" />
</td>
</tr>
<tr class="para">
<td align="right">Info : </td>
<td align="left"><textarea name="body" input type="text" cols="100" rows="20" wrap="VIRTUAL" class="input" value=" <? echo $_SESSION['body']; ?> " /></textarea><br>
<b>Please note that images should be uploaded before writing your article.</b>
</td>
</tr>
<tr class="para">
<td align="right">Page : &nbsp; &nbsp; &nbsp; </td>
<td align="left"><br />
<input type="radio" name="cat" class="input" value="Hardware" />Hardware <br />
<input type="radio" name="cat" class="input" value="Gadgets" />Gadgets <br />
<input type="radio" name="cat" class="input" value="TV" />TV <br />
<input type="radio" name="cat" class="input" value="Software" />Software <br />
<input type="radio" name="cat" class="input" value="Apple" />Apple <br />
<tr class="para">
<td align="right">Article By : </td>
<td width="300" align="left"><input type="text" name="poster" class="input" size="80" maxlength="80" value="<? echo $_SESSION['poster']; ?>" />
</td>
</tr></td>
</td>
</tr>
<tr class="para">
<td align="right">Source : </td>
<td width="300" align="left"><input type="text" name="link" class="input" size="80" maxlength="80" value="<? echo $_SESSION['link']; ?>" /></td>
</tr>
<tr class="para">
<td colspan="2"><hr size="1" /></td>
</tr>
<tr class="para">
<td colspan="2" align="center"><input name="button" type="submit" class="buybutton" value="Submit article" /></td>
</tr>
</form></table>[/HTML]

[Markus]

have a look at mysql_real_escape_string'ing your user input.

Or you could str_replace() the quotes.

[hadge26]

have a look at mysql_real_escape_string'ing your user input.

Or you could str_replace() the quotes.

Hi Mark,

Sorry its taken me so long to reply, got it working in the end thanks to you!

Ta

Harry