mysql character escaping single quotes

Question

I'm inserting some HTML into a MySQL database table. But when I get it back, many characters are mangled. Two specific cases I noted are:

1. the single quotes are getting converted to �,
2. code that earlier read class='content-section developer-support' has got converted to developer-support\="" class="\'content-section"

I understand that its an escaping problem. I use mysql_real_escape_string on the field before I push it into the db.

What is the right way to avoid this problem?

---

source:

    $query = sprintf("insert into events (title, content) values('%s', '%s')",
            mysql_real_escape_string($this->title, $conn),
            mysql_real_escape_string($this->content, $conn)
    );

the text I'm talking about is inserted into the field content.

And yes, I do have magic_quotes enabled. I'll fix that.. thanks

Answer 1

I think you have magic_quotes enabled in your PHP configuration and also, seems, something is trying to clean your HTML. You need to show your source.

Answer 2

It might be worth mentioning that you should maybe look into using prepared statements with MySQLi or PDO. In an essence what you have displayed is pretty similar to executing a prepared statement and it negates the need to use mysql_real_escape_string on every bit of user supplied data. It also has the plus of being more secure and can provide better performance.

Also as noted magic_quotes was most likely your problem.