Subject Re: [firebird-php] Escaping strings
Author Milan Babuskov
Lester Caine wrote:
> This really is a most annoying area - single quotes, double
> quotes, reverse quotes - and all can be mixed up. Wouldn't
> it be nice if a few of the higher characters that are not
> being used were reallocated for this purpose?

It's really a InterBase/Firebird problem, which PHP just tries to avoid.
To insert value: Shaquille O'Neal, you need to insert the quote. INSERT
statement has to look like this:

insert into NBAplayers(name) values ('Shaquille O''Neal');

The double quote is needed since single quote delimits the value.

The basic problem is that when you submit the value via HTML form, all
quotes are automatically escaped by PHP. The default is a common
backslash escape \. I found that setting magic_quotes_sybase to OFF
gives more control about what's going on, since I don't use EVERY
variable to make sql statement. I just str_replace() on final sql
statement: every \' becomes ''

--
Milan Babuskov
http://fbexport.sourceforge.net