Well i created this function that basically automatically goes through the array of $_POST.

 

it works perfectly.

 

but if the value of a post contains ' ' it breaks it. I can see why, my problem is how can i fix this.

 

function post_meta($relocate, $table, $relocate_true)
		{
			global $db, $config, $base;			
			/// Post values are changed into a formatted string for sql.
			foreach($_POST as $key => $value)
				{	
				  $names .= $key.", ";
				  $values .= "'".$value."', ";
				}
				/// Remove two spaces from the string. Removes ,(space).
				$names = substr($names,0,-2);
				$values = substr($values,0,-2);

				/// Create our database sql. 
				$sql = "INSERT INTO ".$config->database_pref.$table." (".$names.") VALUES (".$values.")";		

				/// If Sql Query works, relocate if relocate_true is set to ture. else, log error.

				if ($db->query($sql))
				{ 
					if ($relocate_true) { $base->relocate($relocate); } 
					return true;

				}  else { 
				/// System error if fail
				$base->error_log("Syntax Error".$sql.""); $base->system_error(1);  }
				return false;		
				/// Finnished, returned true or false
		}

 

any ideas? this is not a huge problem because it would have to be ', used and that would be unlikely. but if its fixable that would be better.

Edited June 20, 201115 yr by PhilipMClifton

example of sql using '' in value would create

 

VALUES ('sdfsdf', '''sdfsdfsdf''sdfsdfsdf','sdfsdf''sdfsdf', '',

Edited June 20, 201115 yr by PhilipMClifton

Can you use htmlspecialcharacter filter on it to turn them into ''s?

Or do it manually with a string replace?

 

Edit - the quotes above were meant to read "Ampersand hash 39 semi colon" but the forum filtered them out. Try and use either method to turn them into these.

Edited June 20, 201115 yr by Gibson

Pass them through mysql_real_escape_string, it will correctly quote them for database entry (assuming your using mysql).

 

$filtered = array_map('mysql_real_escape_string', $_POST);

Pass them through mysql_real_escape_string, it will correctly quote them for database entry (assuming your using mysql).

 

$filtered = array_map('mysql_real_escape_string', $_POST);

 

Apologies. I thought the OP was doing this already. On second glance, looks like he's not.

jock that array map caused fields to be missed.

 

CURRENT CODE

 

 

	class store extends base
{
		function post_meta($table, $valid)
		{
			global $db, $config, $base;	

			/// Allow ',' mysql_real_escape_string array
			$filtered = array_map('mysql_real_escape_string', $_POST);

			/// Post values are changed into a formatted string for sql.
			foreach($filtered as $key => $value)
				{	 

					/// CHECK VALIDATION////////////////////////////
					if($valid[$key] == 'html'){  } 
					elseif ($valid[$key] == 'number') { if(!is_numeric($value)){ return false; } } // RETURN FALSE IF NUMBER IS NOT NUMBER
					else { $value = strip_tags($value); }  // STRIPS TAGS IF HTML 
					///// ADD TO STRING
				  $names .= $key.", ";
				  $values .= "'".$value."', ";
				}


				/// Remove two spaces from the string. Removes ,(space).
				$names = substr($names,0,-2);
				$values = substr($values,0,-2);	

				/// Create our database sql. 
				$sql = "INSERT INTO ".$config->database_pref.$table." (".$names.") VALUES (".$values.")";	


				/// If Sql Query works, relocate if relocate_true is set to ture. else, log error.
				if ($db->query($sql))
				{ return true;	}  else { $base->error_log("Syntax Error".$sql.""); $base->system_error(1);  return false; }			

		}

Edited June 20, 201115 yr by PhilipMClifton

 $values .= "'".mysql_real_escape_string($value)."', ";