PHP/MySQL - SQL syntax error?

Question

Now when I submit the character \' I get the following error listed below other then that everything is okay when I submit words. I am using htmlentities()

Answer 1

You need to escape the strings you are sending in your SQL queries.

For that, you can use the mysql_real_escape_string function.

For instance, your code might look like this (not tested, but something like this should do the trick) :

$str = "abcd'efh";
$sql_query = "insert into my_table (my_field) values ('" 
  . mysql_real_escape_string($str)
  . "')";
$result = mysql_query($sql_query);

Another solution (Will require more work, though, as you'll have to change more code) would be to use prepared statements ; either with mysqli_* or PDO -- but not possible with the old mysql_* extension.

Edit : if this doesn't work, can you edit your question, to give us more informations ? Like the piece of code that causes the error ?