PHP MySQLI prepared insert to handle quotes and double quotes - php

Question

I have a prepared mysqli insert statement but when I try to insert data with quotes or double quotes I get this error: Prepare failed: (1064) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Ask me in six months.' We don’t have six months to wait," he said. "I have a p' at line 1
when I use mysqli_real_escape_string around my text that I am trying to insert, it inserts into my database as empty data.
Is there a better way to handle single or double quotes? Or is there something wrong with my code?
$connection = new mysqli("localhost", "username", "password", "database");
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit();
}
if (!($stmt = $connection->prepare("INSERT INTO `in-the-press` (title, `date`, preview, description, image, detailImage, showDetailImage) VALUES ('" . $title . "', '" . $date . "', '" . $preview . "', '" . $description . "','" . $image . "', '" . $detailImage . "', " . $showDetailedImage . ")"))) {
echo "Prepare failed: (" . $connection->errno . ") " . $connection->error;
}else{
$stmt->execute();
echo 'Press has been added <br>';
}
I have tried with mysqli_real_escape_string($title), mysqli_real_escape_string($preview) & mysqli_real_escape_string($description), but like I said it would insert it to the database as empty strings :(

Answer 1

As Micheal said in his comment
Since you're using mysqli with prepare() & execute() you'll be better off harnessing bind_param()
$stmt = $mysqli->prepare("INSERT INTO `in-the-press` (title, `date`, preview, description, image, detailImage, showDetailImage) VALUES (?, ?, ?, ?, ?, ?, ?)");
$stmt->bind_param('sssssss', $title, $date, $preview, $description, $image, $detailImage, $showDetailedImage);
/* execute prepared statement */
$stmt->execute();
printf("%d Row inserted.\n", $stmt->affected_rows);
/* close statement and connection */
$stmt->close();
The above is just an example, I don't know what your database schema/structure looks like
Breakdown:
s means string.
d means double.
You can read more on the types (i, s, d, b) in the bind_param link above.