import csv data with single quote - php

Question

I have a php code to import csv data into mysql. It works fine. The only problem is that it doesn't work if there is a single quote in the data. How can I solve this ?
$conn = mysqli_connect("localhost", "U16******", "***********", "DB16******");
if (isset($_POST["import"])) {
$fileName = $_FILES["file"]["tmp_name"];
if ($_FILES["file"]["size"] > 0) {
$file = fopen($fileName, "r");
fgetcsv($file, 10000, ",");
while (($column = fgetcsv($file, 10000, ",")) !== false) {
$sqlInsert = "INSERT into tblrabobank (IBAN_BBAN,Munt,BIC,Volgnr,Datum,Rentedatum,Bedrag,Saldo_na_rtn,Tegenrekening_IBAN_BBAN,Naam_tegenpartij,Naam_uiteindelijke_partij,Naam_initierende_partij,BIC_tegenpartij,Code,Batch_ID,Transactiereferentie,Machtigingskenmerk,Incassant_ID,Betalingskenmerk,Omschrijving1,Omschrijving2,Omschrijving3,Reden_retour,Oorspr_bedrag,Oorspr_munt,Koers)
values ('" . $column[0] . "','" . $column[1] . "','" . $column[2] . "','" . $column[3] . "','" . $column[4] . "','" . $column[5] . "','" . $column[6] . "','" . $column[7] . "','" . $column[8] . "','" . $column[9] . "','" . $column[10] . "','" . $column[11] . "','" . $column[12] . "','" . $column[13] . "','" . $column[14] . "','" . $column[15] . "','" . $column[16] . "','" . $column[17] . "','" . $column[18] . "','" . $column[19] . "','" . $column[20] . "','" . $column[21] . "','" . $column[22] . "','" . $column[23] . "','" . $column[24] . "','" . $column[25] . "')";
$result = mysqli_query($conn, $sqlInsert);
if (!empty($result)) {
$type = "success";
$message = "CSV Data geimporteerd in de database";
} else {
$type = "error";
$message = "Probleem met importeren CSV Data";
}
}
}
}

Answer 1

you should use PDO extension to mysql together with prepared statement rather than concatenation to build the query, that will handle the single quote issue and will protect your code against SQL injections.
Something like this :
$stmt = $dbh->prepare("INSERT INTO tblrabobank (IBAN_BBAN,Munt,BIC,Volgnr,Datum,Rentedatum,Bedrag,Saldo_na_rtn,Tegenrekening_IBAN_BBAN,Naam_tegenpartij,Naam_uiteindelijke_partij,Naam_initierende_partij,BIC_tegenpartij,Code,Batch_ID,Transactiereferentie,Machtigingskenmerk,Incassant_ID,Betalingskenmerk,Omschrijving1,Omschrijving2,Omschrijving3,Reden_retour,Oorspr_bedrag,Oorspr_munt,Koers) VALUES (:iban, :munt, ...........)");
$stmt->bindParam(':iban', $column[0]);
$stmt->bindParam(':munt', $column[1]);
[.....]
$stmt->execute();
check this page for more details https://www.php.net/manual/en/pdo.prepared-statements.php

Answer 2

You can try something like this..
<?php
$dbh = new PDO('mysql:host=localhost;dbname=test', $user, $pass);
if (isset($_POST["import"])) {
$fileName = $_FILES["file"]["tmp_name"];
if ($_FILES["file"]["size"] > 0) {
$file = fopen($fileName, "r");
fgetcsv($file, 10000, ",");
$dataToInsert = [];
$columns = explode(',','IBAN_BBAN,Munt,BIC,Volgnr,Datum,Rentedatum,Bedrag,Saldo_na_rtn,Tegenrekening_IBAN_BBAN,Naam_tegenpartij,Naam_uiteindelijke_partij,Naam_initierende_partij,BIC_tegenpartij,Code,Batch_ID,Transactiereferentie,Machtigingskenmerk,Incassant_ID,Betalingskenmerk,Omschrijving1,Omschrijving2,Omschrijving3,Reden_retour,Oorspr_bedrag,Oorspr_munt,Koers');
while (($column = fgetcsv($file, 10000, ",")) !== FALSE) {
$sql = "INSERT INTO tblrabobank (".implode(',', $columns).") VALUES (";
foreach($column as $key => $value){
$dataToInsert[":".$columns[$key]] = $value ?? null;
}
$sql .= "(".implode(',',array_keys($dataToInsert)).")";
$stmt = $dbh->prepare($sql);
foreach($dataToInsert as $key => $value){
$stmt->bindParam($key, $value);
}
if($stmt->execute()){
$type = "success";
$message = "CSV Data geimporteerd in de database";
} else {
$type = "error";
$message = "Probleem met importeren CSV Data";
}
}
$stmt->execute();
}
}
?>
In the above code snippet,
you can make an array of the given columns, and attach each value to a 2D array with keys made of the columns and their corresponding values from csv.
The append each column to the sql statement, using array_keys and bing each value.
This is scalable for small dataset but with huge number of columns.
For a large number of data set, sql queries will be multiple. You should consider in mind that too.
Source:
https://www.php.net/manual/en/pdostatement.execute.php (execute statement of PDO)
https://www.php.net/manual/en/pdostatement.bindparam.php (binding a parameter)
https://www.php.net/manual/en/pdo.connections.php (how to make and use connections in PDO)