How can I escape an ampersand in php before sending to a db?

Question

Wierd thing is happening when I send data to my database. Anything after the ampersand is dropped as if it were never typed and everything before it is left intact. Can someone please tell me what I should use to preserve this character? REGEX? PHP function?

Thanks

EDIT:

code:

// The POST var contains data entered by the user so could be anything really. This is coming from a WYSIWYG editor.

$string = addslashes($_POST['txtarea']);

mysql_query("INSERT INTO...'$string'");

---

        WYSIWYG.updateTextArea(n);
        var form = WYSIWYG_Core.findParentNode("FORM", this.getEditor(n));
        if(form == null) {
            alert("Can not submit the content, because no form element found.");
            return;
        }
        form.submit();

I want to echo the string out of what is being submitted. Can someone tell me what I need to place into this case to do that please? Is it alert(n)?

---

OK guys.. I got it to echo. I'm using an AJAX interface for this and just echo'd the values from there. WHen I add an ampersand in the the string, I get:

test&&

So.... it's not the editor..

Answer 1

My guess is somehow the '&' is making it, unencoded, into your query string like:

http://yoursite/?message=hello&whatsup

This will resulting in the GET variable "message" Having the value of "hello" and the GET variable "whatsup" having an empty value.

If this is happening, you just need to stop it.

You can encode it as '%26' in the querystring.

Answer 2

I think something is wrong with your WYSIWYG editor.

Answer 3

Looks like the bug is with your WYSIWYG editor, not with the insertion of data into the database then. Try capturing the output with JavaScript before the form is posted to be sure.

Answer 4

This may or may not solve your problem, but in general, when ever you need to escape arbitrary characters, you can use PHP's addcslashes, which allows you to define a set or range of characters to escape.