views:

185

answers:

1

I am using adodb with php. I need to insert html into my database, and need to know the best method to escape the quotes before inserting it into the database? I tried using pg_escape_string() but it still does not seem to insert.

What is the best method to do this?

+1  A: 

The best method is to use a parameterized query. See here to get started:

Tomalak
I am not sure I understand how this will help in escaping.
Nic Hubbard
@Nic: But that is the whole *point* of parameterized queries. You don't need any escaping. You pass the raw string into the parameter, and that's it.
Tomalak
Ok, I guess even after looking at those posts I am still every confused how to use parameterized queries.
Nic Hubbard
$sql = "INSERT tbl (id, html) VALUES (?, ?)"; $results = $this->db->Execute($sql, array($id_val, $html_string));
Tomalak
@Nic: Why ask me a question that is best suited for Google? Common sense applied, there must be tons of tutorials across the web, since there are tons of tutorials for almost *any* topic. It seems to me that you have not bothered looking into the topic of parameterized queries *at all*, so far. It's not that hard, really. All you got to do is do some basic reading, so I'm unsure where the actual problem is right now.
Tomalak