I am creating a messaging system but the problem I face is that when users try and enter certain characters like ' into the message, the database doesnt want to allow it. Any idea what this is?
+2
A:
This is called SQL injection. Basically, by not handling your user input properly, you're allowing anyone and everyone to execute arbitrary SQL statements (not good!). If you search for 'SQL Injection', you'll get tonnes of resources.
For starters, have a look at this question: http://stackoverflow.com/questions/60174/best-way-to-stop-sql-injection-in-php
Chris Smith
2010-05-26 10:18:05
I know about SQL injection but i'm unaware how to allow the users to enter messages with such characters. mysql_real_escape_string?
Luke
2010-05-26 10:22:30
@Luke That's one solution. The question I linked to has some really good answers that outline other possibilities.
Chris Smith
2010-05-26 10:49:24
@Luke while "SQL inection" is terrible term to describe your problem, the solution is the same
Col. Shrapnel
2010-05-26 11:15:08
@Col. Shrapnel - Why's it a terrible term? If the DB is throwing errors when the user inputs `'` then it's almost certainly a SQL injection vulnerability.
Chris Smith
2010-05-26 11:22:26
I have looked at the solutions you provided. Thanks
Luke
2010-05-26 11:24:19
"SQL injection" stands for "SQL injection attack", not "SQL injection vulnerability". And it's not actually a vulnerability but just malformed query.
Col. Shrapnel
2010-05-26 11:29:24