What characters ARE allowed when querying a mysql database?

Question

I have a textarea in a form, when I enter special characters in it, I get an error in mysql. (when submitting the form to a php-file which does the work of inserting into mysql)

I need to know exactly what characters that aren't allowed, or easier would be, exactly what characters thar ARE allowed, so that I could validate the textarea before submitting.

Does anybody know?

I have tried mysql_real_escape_string() but didn't help...

NOTE: In the textarea, users are supposed to enter some special chars like these:

 + , . ; : - _ space & % ! ? = # * ½ @ / \ [ ] ' " < > £ $ €

Probably got them all...

how can I do this?

Thanks

UDPATE

My mysql_query :

mysql_query("INSERT INTO cars_db (description) VALUES ('$ad_text')");

UPDATE

Mysql error:

    You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'a"a!a?aa+a-a_a
a/a\a[a]a}a{a&a%a#a@a¨a^a*a*aa,a.a:a;a|a½a
§a' at line 1

Answer 1

A database column can technically hold any of those characters. The problem is that you are not escaping them properly in your query.

One way way to do this using mysql_real_escape_string is as follows:

$sql=sprintf("insert into cars_db (description) values ('%s')",
    mysql_real_escape_string($_POST['description']) );

//execute query and show errors that result...
$result = mysql_query($sql);
if (!$result) {
    die("Oops:<br>$sql<br>".mysql_error());
}

Another way is to use a library like PDO or ADODb which makes it easier to use prepared statements with placeholders. Such libraries ensure that data injected into queries is properly escaped.

This is good practice not only because it solves your problem, but it also improves the security of your code, since it becomes harder to perform SQL injection attacks.

Answer 2

Another way would be to use prepared statements. This makes sure SQL injection isn't possible.

Answer 3

Do this:

$ad_text = mysql_real_escape_string($ad_text);
mysql_query("INSERT INTO cars_db (description) VALUES ('$ad_text')");

Read up on mysql_real_escape_string and SQL injection. This is a massive security hole in your application.

http://us.php.net/mysql%5Freal%5Fescape%5Fstring

Answer 4

Instead of escaping characters so as not to trip up your query, why not create a stored procedure with an incoming String parameter. Just pass the form variable's value (or save it to a string) and pass that to the stored procedure.