apostrophe not send to database - php

Question

i need your help. today i saw that if i put '(apostrophe) in some words then this text will not send to database. I tride to delete htmlentites or htmlspecialchars but not helped. please help me to fix this problem. thanks.
hier is profile.php
<?php
if(logged_in() === true){
if(empty($_POST['status']) === false && empty($_POST['user_status']) === false){
$status_data = array(
'body' => $_POST['status'],
'added_by' =>$user_data['username'],
'date_added' => date('Y-m-d H:i:s'),
'user_posted_to' => $_GET['username'],
'user_id' => $user_data['user_id']
);
update_status($id, $status_data, $user_id);
}
?>
<form class="forma" action="<? echo $username; ?>" method="post" accept-charset="utf8">
<div class="field">
<label for="Status" style="color: #7f7f7f; font-family: Cambria, Hoefler Text, Liberation Serif, Times, Times New Roman, serif;"></label>
<textarea rows="4" cols="50" name="status" placeholder="say something" id="status_area" charset="UTF-8" style=".value:black;"></textarea>
<div class='fild_bottom'>
<input name="user_status" type="submit" value="Post" id="button">
</div>
</div>
</form>
Here is function.php:
function update_status($id, $status_data, $user_id){
$query = #mysql_query('set character_set_results = "utf8"');
$user_id = mysql_query("SELECT * FROM users WHERE user_id = $user_id");
array_walk($status_data, 'array_sanitize');
$fields = '`' . implode('`,`', array_keys($status_data)) . '`';
$bank ='\'' . implode('\', \'', $status_data) . '\'';
mysql_query("INSERT INTO `status` ($fields) VALUES ($bank)");
}
function array_sanitize($item){
$item = htmlentities(strip_tags(mysql_real_escape_string($item)));
}
function sanitize($data){
return htmlspecialchars(strip_tags(mysql_real_escape_string($data)));
}

Answer 1

Please change your code to PDO. For an example, I'm refering to this SO Question
Change your function update_status to this (it's implied you've already made an db connection (object in $db)):
/* $user_id is unused, you should think about removing it */
function update_status($id, $status_data, $user_id) {
global $db;
$link = $db->prepare("INSERT INTO `status` (`body`, `added_by`, `date_added`, `user_posted_to`, `user_id`) VALUES (?, ?, ?, ?, ?)");
$link->bindvalue(1, $status_data['body']);
$link->bindvalue(2, $status_data['added_by']);
$link->bindvalue(3, $status_data['date_added']);
$link->bindvalue(4, $status_data['user_posted_to']);
$link->bindvalue(5, $status_data['user_id']);
$link->execute();
}
And remove the functions array_sanitize() and sanitize(), you won't need them anymore (Thanks to PDO and Prepared Statements). Also there is no need to use array_keys on the $status_data array, if the keys are always the same and known.
I don't know why you're selecting the user_id again in this function, since you're already getting it in $status_data.
edit: Throw this in a central file (you can either set the variables before try { or replace them with the correct values):
try {
$db = new PDO("mysql:host=".$host.";dbname=".$db.";charset=utf8", $user, $password);
$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); //Stops emulating Prepared Statements
} catch(PDOException $e) {
die("Unable to connect. Error: ".$e->getMessage());
}