' <-- Need help

[Shibby-Shabs]

Ok so I've got a simple page editor:

$update = mysql_query("UPDATE pages SET body='$_POST[content]' WHERE id='$_GET[id]'") or die(mysql_error());
  die("<b>The page has successfully been updated!</b>"); 

but if I in the text area where you edit I put a " or ' it gives me an error that says this:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'll' WHERE id='1'' at line 1

Obviously it's the ' in the mysql query but how do I prevent?

BTW: it has ll 'cos for the example I wrote ya'll

[Johno]

http://php.net/manual/en/function.my...ape-string.php
http://www.php.net/manual/en/function.addslashes.php
http://www.php.net/manual/en/function.stripslashes.php

Have a look through those, it should help

$update = mysql_real_escape_string(mysql_query("UPDATE pages SET body='$_POST[content]' WHERE id='$_GET[id]'")) or die(mysql_error());
  die("<b>The page has successfully been updated!</b>"); 

You really should be sanitising your data input too, hence why this is happening. Another few good things to pick up on are:

http://php.net/manual/en/function.htmlspecialchars.php
http://www.php.net/manual/en/functio...ars-decode.php
http://www.php.net/manual/en/function.strip-tags.php

[Dentafrice]

<?php 

$id = mysql_real_escape_string($_GET['id']); // gets the ID from the page.  blah.php?id=1

// This below will check to make sure the page actually exists in the database... //
$check_id = mysql_num_rows(mysql_query("SELECT * FROM `pages` WHERE `id`='$id' LIMIT 0,1"));

if(!$check_id) {
    exit("Page does not exist."); // page doesn't exist.
}

$content = mysql_real_escape_string($_POST['content']);

$update = mysql_query("UPDATE `pages` SET `body`='$content' WHERE `id`='$id'") or die(mysql_error());

echo "<strong>The page has been updated successfully!</strong>";

?>