mySQL insert syntax error with quote

Question

I\'m receive the following error below, I believe its do in part the quote that I have in the insert string 5\'10 - (178cm) in which is passed by the $en[\'he

Answer 1

Your issue is that you must "escape" strings before inputting them into SQL queries. Not doing that will allow people to alter your query by inputting quotes. Example if I input the following string:

'; select * from users; --

Its possible to execute SQL that you did not intend. The solution is to escape:

m_height = '".mysql_real_escape_string($en['height'])."',

Or better yet use a more up to date method of querying mysql such as PDO or mysqli functions.

Edit I also think you have a more general syntax error. Try this:

m_height = "'".mysql_real_escape_string($en['height'])."'",