Using an apostrophe inside a query - php

Question

So using prepared statements im trying to query with a '
i have a string called $awayteam wich holds : SSS'18 VR1
When i try to query the DB with above string it wont work....
$conn = new PDO($link, $pdo_username, $pdo_password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $conn->prepare("SELECT * FROM clublogo WHERE naam = :name");
//$stmt->bindParam(':name', $awayteam);
$stmt->bindParam(':name', $awayteam, PDO::PARAM_STR);
$stmt->execute();
$result = $stmt->fetchAll();
foreach($result as $row){
$awayclublogo = sprintf($row[pad]);
}
$conn = null;
$awayclublogo will be NULL
However when i do it with just TEXT it does work.
$conn = new PDO($link, $pdo_username, $pdo_password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $conn->prepare("SELECT * FROM clublogo WHERE naam = :name");
$stmt->bindValue(':name', "SSS'18 VR1");
$stmt->execute();
$result = $stmt->fetchAll();
foreach($result as $row){
$awayclublogo = sprintf($row[pad]);
}
$conn = null;
OK So #Devon pointed out that the problem was due to HTML encoding.
Told me to look at the source, and sure he was right.
SSS'18 VR
im getting the variable from the DB like :
$conn = new PDO($link, $pdo_username, $pdo_password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $conn->prepare("SELECT * FROM vrip_uitslag WHERE GameID = :name");
$stmt->bindParam(':name', $gameid);
$stmt->execute();
$result = $stmt->fetchAll();
foreach($result as $row) {
$hometeam = sprintf($row[Thuis]);
$awayteam = sprintf($row[Uit]);
}
var_dump($awayteam) will result : string(15) "SSS'18 VR1"
i then use $awayteam so i have no clue where the HTML encoding is happening....

Answer 1

I think it's been established that this is solved using prepared statements since you're using PHP. This would handle this automatically.
In SQL in general, you can escape it in a couple ways:
Use another apostrophe (single quote) before it:
'SSS''18 VR1'
Use the backslash before it:
'SSS\'18 VR1'

Answer 2

Double up on single quotes. Add an extra single quote to escape it.
SELECT * FROM clublogo WHERE name = 'SSS''18 VR1'
Use prepared statements if you are using PDO.
$dbh = new PDO("...");
$stmt = $dbh->prepare("SELECT * FROM clublogo WHERE name = :name");
$stmt->bindValue(':name', "SSS'18 VR1");
$stmt->execute();
$result = $stmt->fetchAll();
You have to use bindParam if you are using a variable.
$dbh = new PDO("...");
$stmt = $dbh->prepare("SELECT * FROM clublogo WHERE name = :name");
$stmt->bindParam(':name', $awayteam, PDO::PARAM_STR);
$awayteam = "SSS'18 VR1";
$stmt->execute();
$result = $stmt->fetchAll();
PDO: Prepared statements