Query with special characters in PHP - php

Question

I have a problem with queries that contains ' in names.
Select HTML:
<select id="list-skins" name = "specific_skins_list[]" multiple="multiple" style="width: 500px">
<?php
$get_all_skins_list= mysqli_query($conn, "SELECT * FROM skins_list");
while($row = mysqli_fetch_array($get_all_skins_list)) {
$skins_name = $row["skins_list"];
$skins_id = $row["id"];
$skins_name = str_replace("'", "’", $skins_name);
echo '<option value="'.$skins_name.'">'.$skins_name.'</option>';
}//END WHILE GET_ALL_REGIONS
?>
</select>
POST
if (isset($_POST["specific_skins_list"])) {
$query .= "
AND skins LIKE '%" . implode("%' or skins LIKE '%", $_POST['specific_skins_list']) ."%'
";
}
My problem is: in table skins_list, I have names like:
i'oan , v'asilivev etc...
These names contain a ' .
The query works fine if the names are normal without special characters. I found couple solutions in my search to use mysqli_real_escape_string.
I tried to do something like this:
if (isset($_POST["specific_skins_list"])) {
$skins = mysqli_real_escape_string($conn,$_POST["specific_skins_list"]) ;
$query .= "
AND skins LIKE '%" . implode("%' or skins LIKE '%", $skins) ."%'
";
}
but I get this error:
mysqli_real_escape_string() expects parameter 2 to be string, array given in... my page
And the query is like this :
SELECT *
FROM import_acc
WHERE available = 'YES' AND region = 'UVAS' AND st= 'Truex' AND skins LIKE '%%' "
Thank you for your time.
P.S. I think the only way i can fix this is to modified all table skins_list and add manulaly double '' to every name :D

Answer 1

You defined the fields as "specific_skins_list[]", so it produces an array instead of a string, and that's why you get the error. mysqli_real_escape_string only works on strings.
The simplest way to solve this is to loop on this array, calling mysqli_real_escape_string on each element, e.g:
$skins = [];
foreach($_POST["specific_skins_list"] as $skin)
$skins[] = mysqli_real_escape_string($conn,$skin);
Now your $skins variable contains properly formatted strings for an SQL query (probably).
Of course, in a real script you should do a lot more validation - you should make sure that $_POST["specific_skins_list"] is defined and is indeed an array (using isset and is_array), and that each element is a valid skin name or something (e.g. using preg_match).
Otherwise your script may generate lots of errors or your DB can be hacked if someone uses the script directly, bypassing your UI.