PHP MySQL query problem with string despite using mysql_real_escape_string

Question

The following SQL query:

INSERT INTO `database`.`table` (`param1`, `param2`) 
VALUES (
'Новости Томска – подборка новостей из общественной жизни города, политики, спорта, обзор происшествий, событий.\r\nПолезная информация о недвижимости, авто, финансах, работе и консультации специалистов.\r\nОбъявления по различным тематикам, вакансии томских работодателей. \', 
'Томский городской портал, Томск, Портал города Томска, Недвижимость в Томске, Авторынок Томска, Продажа авто в Томске, Работа в Томске, Вакансии, Резюме, Отдых в Томске, Афиша Томска, Новости Томска, Томский форум, Погода в Томске, Томские сайты, Каталог томских сайтов, Частны');

failed with error message:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Томский городской портал, Томск, Портал гор' at line 1

I have used mysql_real_escape_string on the strings before using them on the SQL query, so I thought this was enough to make them error-free.

My database is set to use

utf8_general_ci

as Collation for these fields.

What can be the problem with the query?

why not to post here full code? I see no reason to get such error from PHP code. — Your Common Sense
– Your Common Sense, Commented Mar 31, 2011 at 10:46

Pascal MARTIN · Accepted Answer · 2011-03-31 10:44:43Z

6

You are escaping the ' that should close the value of param1 (the first value in the values clause) :

INSERT INTO `database`.`table` (`param1`, `param2`) 
VALUES (
'...й. \',   <= there
'...ны');

You should remove the \ before the closing ', so your query looks like this :

INSERT INTO `database`.`table` (`param1`, `param2`) 
VALUES (
'...й. ', 
'...ны');

The \ is necessary to escape quotes inside the strings -- and not quotes that are string delimiters.

answered Mar 31, 2011 at 10:44

Pascal MARTIN

402k82 gold badges665 silver badges666 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Timothée HENRY Over a year ago

Thanks! Is the PHP function stripslashes the way to best way to "clean" the string before using it for a MySQL query?

Pascal MARTIN Over a year ago

No : you should use the escaping function that corresponds to your database driver -- mysql_real_escape_string if you're working with mysql_* function. But you must escape each string separately.

Collectives™ on Stack Overflow

PHP MySQL query problem with string despite using mysql_real_escape_string

1 Answer 1

2 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Related