Mysql and Php (Could not enter data) - php

Question

I need assistance to what might be causing this error, I get this error everytime I have single inverted commas in the data I am trying to post to the database. (field name: abtext)
Error message:
Could not enter data: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'dsf'ds'f'ds'fds'f'ds'f'dsfds','fdsfdd'fd''fds'f'dsf'ds fd 'fds'f'df'ds ds''fd'sf' at line 3
Data entered to the db:
field name: (abtext) of type text
data entered on the field=
fdsfdd'fd''fds'f'dsf'ds fd 'fds'f'df'ds ds''fd'sf'ds'f'dsfds'sdf
My insert code:
$sql = "INSERT INTO poster
(titlepaper,abtext,authorTitle1,authorName1,authorIntials1,authorSurname1,authorJt1,authorcompany1,authoremail1,authornumber1,presenting1,additional,authorTitle2,authorName2,authorIntials2,authorSurname2,authorJt2,authorcompany2,authoremail2,authornumber2,presenting2,correspondence,authorTitle3,authorName3,authorIntials3,authorSurname3,authorJt3,authorcompany3,authoremail3,authornumber3,presenting3)
VALUES ('$titlepaper','$abtext','$authorTitle1','$authorName1','$authorIntials1','$authorSurname1','$authorJt1','$authorcompany1','$authoremail1','$authornumber1','$presenting1','$additional','$authorTitle2','$authorName2','$authorIntials2','$authorSurname2','$authorJt2','$authorcompany2','$authoremail2','$authornumber2','$presenting2','$correspondence','$authorTitle3','$authorName3','$authorIntials3','$authorSurname3','$authorJt3','$authorcompany3','$authoremail3','$authornumber3','$presenting3')";
mysql_select_db('database');
$retval = mysql_query( $sql, $conn );
if(! $retval ) {
die('Could not enter data: ' . mysql_error());
}
Your help will be much appreciated.

Answer 1

Try this,
$sql = " INSERT INTO poster(titlepaper,abtext,authorTitle1,authorName1,authorIntials1,authorSurname1,authorJt1,authorcompany1,authoremail1,authornumber1,presenting1,additional,authorTitle2,authorName2,authorIntials2,authorSurname2,authorJt2,authorcompany2,authoremail2,authornumber2,presenting2,correspondence,authorTitle3,authorName3,authorIntials3,authorSurname3,authorJt3,authorcompany3,authoremail3,authornumber3,presenting3)
VALUES (" . mysql_escape_string($titlepaper) . "," . mysql_escape_string($abtext) . "," . mysql_escape_string($authorTitle1) . "," . mysql_escape_string($authorName1) . "," . mysql_escape_string($authorIntials1) . "," . mysql_escape_string($authorSurname1) . "," . mysql_escape_string($authorJt1) . "," . mysql_escape_string($authorcompany1) . "," . mysql_escape_string($authoremail1) . "," . mysql_escape_string($authornumber1) . "," . mysql_escape_string($presenting1) . "," . mysql_escape_string($additional) . "," . mysql_escape_string($authorTitle2) . "," . mysql_escape_string($authorName2) . "," . mysql_escape_string($authorIntials2) . "," . mysql_escape_string($authorSurname2) . "," . mysql_escape_string($authorJt2) . "," . mysql_escape_string($authorcompany2) . "," . mysql_escape_string($authoremail2) . "," . mysql_escape_string($authornumber2) . "," . mysql_escape_string($presenting2) . "," . mysql_escape_string($correspondence) . "," . mysql_escape_string($authorTitle3) . "," . mysql_escape_string($authorName3) . "," . mysql_escape_string($authorIntials3) . "," . mysql_escape_string($authorSurname3) . "," . mysql_escape_string($authorJt3) . "," . mysql_escape_string($authorcompany3) . "," . mysql_escape_string($authoremail3) . "," . mysql_escape_string($authornumber3) . "," . mysql_escape_string($presenting3) . ")";
mysql_select_db('database');
$retval = mysql_query($sql, $conn);
if (!$retval) {
die('Could not enter data: ' . mysql_error());
}
i have changed insert area of insert command. Used mysql_escape_string for escaping unwanted char in insertion variables.

Answer 2

$sql = "INSERT INTO individual
(titlepaper,abtext,authorTitle1,authorName1,authorIntials1,authorSurname1,authorJt1,authorcompany1,authoremail1,authornumber1,presenting1,additional)
VALUES ('". mysql_escape_string($titlepaper) . "','" . mysql_escape_string($abtext) . "','" . mysql_escape_string($authorTitle1) . "','" . mysql_escape_string($authorName1) . "','" . mysql_escape_string($authorIntials1) . "','" . mysql_escape_string($authorSurname1) . "','" . mysql_escape_string($authorJt1) . "','" . mysql_escape_string($authorcompany1) ."','" . mysql_escape_string($authoremail1) . "','" . mysql_escape_string($authornumber1) . "','" . mysql_escape_string($presenting1) . "','" . mysql_escape_string($additional) . "')";
This worked! THANKS ALOT GUYS MUCH APPRECIATED!

Answer 3

Please try by using : htmlspecialchars($abtext)
so your sql query would be like,
$sql = "INSERT INTO poster
(titlepaper,abtext,authorTitle1,authorName1,authorIntials1,authorSurname1,
authorJt1,authorcompany1,authoremail1,authornumber1,presenting1,additional,
authorTitle2,authorName2,authorIntials2,authorSurname2,authorJt2,authorcompany2,
authoremail2,authornumber2,presenting2,correspondence,authorTitle3,authorName3,
authorIntials3,authorSurname3,authorJt3,authorcompany3,authoremail3,
authornumber3,presenting3)
VALUES
('$titlepaper','htmlspecialchars($abtext)','$authorTitle1','$authorName1',
'$authorIntials1','$authorSurname1','$authorJt1','$authorcompany1',
'$authoremail1','$authornumber1','$presenting1','$additional',
'$authorTitle2','$authorName2','$authorIntials2','$authorSurname2',
'$authorJt2','$authorcompany2','$authoremail2','$authornumber2',
'$presenting2','$correspondence','$authorTitle3','$authorName3',
'$authorIntials3','$authorSurname3','$authorJt3','$authorcompany3',
'$authoremail3','$authornumber3','$presenting3')";