Extended ascii characters in mySql with prepared statements - php

Question

When inserting (or updating) a record in mysql using prepared statements and binding of values, I ran into a problem trying to insert the word child’s which contains the extended ascii character 145 (right single quotation mark). All data after the "d" is truncated. This is true for inserting any of the MS Word odd characters. My table is encoded as utf8_general_ci and I'm utf-8 all the way through in my code. The field is of type "text."
Of course I can escape them or do a str_replace() to remove them (which is what I am choosing to do), but I'd like to understand why I can't insert them directly since I always thought prepared statements handled this.
Sample insert code - incomplete, but it shows the essential
$q = "INSERT INTO mytable (userid, title, descr) VALUES (?,?,?)";
if (!($stmt = $this->mysqli->prepare($q))) {
error_log("You have a problem...");
return false;
}
/* bind parameters for markers */
$stmt->bind_param("iss", $userid, $title, $descr);
/* execute query */
$stmt->execute();
if ($stmt->errno) {
$e = new Exception;
error_log("\r\nSql Error: " . $q . ' Sql error #: ' . $stmt->errno . ' - ' . $stmt->error . "\r\n" . $e->getTraceAsString());
return false;
} else {
$lastinsertedid = $this->mysqli->insert_id;
/* close statement */
$stmt->close();
return $lastinsertedid;
}

Answer 1

This should not be an issue, binding the param as a string should escape any quotes as needed.
Try this to see if you can see what the error is.
$stmt = $this->mysqli->prepare($q);
if (!is_object($stmt))
error_log("You have a problem...");
var_dump($this->mysqli);
}
P.S. Don't forget $stmt->close() after $stmt->execute() as you will run into out of sync issues when attempting multiple prepared statements
I can offer some tips on syntax clean up too, take your updated question:
$q = "INSERT INTO mytable (userid, title, descr) VALUES (?,?,?)";
$stmt = $this->mysql->prepare($q);
if (!is_object($stmt))
error_log("You have a problem...");
var_dump($this->mysqli);
}
/* bind parameters for markers */
$stmt->bind_param("iss", $userid, $title, $descr);
/* execute query */
$stmt->execute();
if ($stmt->errno) {
$stmt->close(); // Still need to close here
$e = new Exception;
error_log("\r\nSql Error: " . $q . ' Sql error #: ' . $stmt->errno . ' - ' . $stmt->error . "\r\n" . $e->getTraceAsString());
return false;
}
/* close statement */
$stmt->close();
return $this->mysqli->insert_id;

Answer 2

The encoding for ’ was not utf8. That is the only problem. Your code may be utf8 throughout, but the data was not.
The fact that child’s truncated after the d is the symptom non-utf8 bytes being fed into otherwise good code.
Find out what application or code is generating the ’, either figure out what encoding it is generating or figure out whether it can be made to generate utf8. In the former case, we need to change one setting, in the other case, no code change need be made.
HEX('’') is E282AC in utf8.