0

My Code looks like below.

$var = 'ID="'. mysql_real_escape_string($data[0]).'" AND SYS="'.mysql_real_escape_string($data[2]). '" AND TITLE="'.mysql_real_escape_string($data[1]).'"';
$sql = 'SELECT * FROM `table_name` WHERE '. $var;
$result = mysql_query($sql);

In the where condition, TITLE when using a single quote(') I am facing the below error even though the mysql_real_escape_string() function is being used.

The error thrown is

Resource id #5You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's Created', 'Test', 'Test', '0000-00-00 00:00:00', ' at line 25
6
  • post your table columns
    – echo_Me
    Feb 11, 2014 at 10:14
  • 1
    You posted the SELECT query while it's painfully obvious that this is an INSERT/UPDATE error..
    – N.B.
    Feb 11, 2014 at 10:17
  • problem in not in above query. may be there is another insert query Feb 11, 2014 at 10:17
  • 1
    This doesn't answer your question directly but I know it will help. I highly recommend using either PDO or MySQLi from now on for all your database calls. All of PHP's mysql_* functions have officially been deprecated.
    – Armin
    Feb 11, 2014 at 10:18
  • try to echo error like this $result = mysql_query($sql) or die("Problem1 ".mysql_error()); Feb 11, 2014 at 10:18

3 Answers 3

0

after your dumping looks like you have problem with apostroph

you may change your quotes like that

  $var = "ID='". mysql_real_escape_string($data[0])."' AND SYS='".mysql_real_escape_string($data[2]). "' AND TITLE='".mysql_real_escape_string($data[1])."' ";
  $sql = "SELECT * FROM `table_name` WHERE ". $var;
  $result = mysql_query($sql);
0
0

$finalvar=stripslashes($var);

$sql = 'SELECT * FROM table_name WHERE '. $finalvar;

2
  • The array variable data are as follows ID="12345" SYS="Test" TITLE="Test's Created". Where the TTILE is escaped as "Test\'s Created" Feb 11, 2014 at 10:41
  • Hello Rajesh, I am facing the same error after using the stripslashes() also. Feb 11, 2014 at 12:41
-1

Try dumping your SQL query in its compete form right before it is sent. You'll be able to spot the error that way.

2
  • when i dump it the sql looks like this SELECT * FROM table_name WHERE ID="123456" AND SYS="Test" AND TITLE="Test\'s Created" Feb 11, 2014 at 10:26
  • I am still facing the error even after escaping the single quote. Feb 11, 2014 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.