views:

70

answers:

2

hi there,

i am posting data with jquery ajax to php but if input has ' inside, data wont be posted. I tried encodeURIComponent but wont work.

any idea on this ?

thanks

EDIT: my code

var name = $("input#name_add").val();
         name = encodeURIComponent(name);

$.post("function.php", { name: name }, function(data) {

                               //codes
                });



$query = "UPDATE `table` SET name = '" . stripslashes($_POST['name']) . "' WHERE ID = '$id'";
$result = mysql_query($query);
if ($result){
print "ok";

}
A: 

Try checking the magic quotes setting on your server with get_magic_quotes_gpc(). If it's on you need to strip_slashes() before using using mysql_real_escape_string().

Check the get_magic_quotes_gpc() documentation for an example.

Anax
checked, it is off
Ahmet vardar
damn, i cant find anything about escaping apostrophes in javascript
Ahmet vardar
A: 

If magic_quotes_gpc is off why are you stripping slashes in your query?

Try:

$query = "UPDATE `table` SET name = '" . mysql_real_escape_string($_POST['name']) . "' WHERE ID = '$id'";

If you're using POST you shouldn't need to escape the data before passing it, but by using stripslashes in your code for the mysql you're gonna cause problems with any apostrophes as then your sql won't be escaped.

"If you're using POST you shouldn't need to escape the data before passing it" but special chars break ajax if i didnt escape in javascript
Ahmet vardar
@Ahmet vardar Is that all of your code? You're using `encodeURIComponent` in your js but stripping slashes in the php. `encodeURIComponent` encodes data with hex codes not slashes, so why are you stripping slashes. By stripping slashes there you're passing non escaped data to mysql which will cause it to break anyway when you use apostrophes let alone the mysql injection problems.
ok i replaced strip slash with mysql_real_escape_string, and in js i made this as temp. solution name=name.replace("'"," ");
Ahmet vardar