How to insert a string that contains quote marks into a database?

Question

When I try to instert a string that contains a quote mark, the INSERT query fails. How can I insert strings with single or double quotes?

for example:

$message = "Bob said 'don't forget to call me'";

mysql_query("INSERT INTO someTable (messages) VALUES ('$message')");

I figure the input needs to be filtered but which function should I use for that?

Answer 1

See: mysql_real_escape_string

You should ALWAYS be escaping things anything provided by the user before they go it goes into the database to prevent SQL injection in any case.

Answer 2

$message = mysql_real_escape_string($message);

this function should be applied to every variable you are going to insert into query in quote marks. No exceptions.
It is not really protection from sсaring injection but just a syntax rule.

Though you will need a real protection too. I've explained that in detail in recent answer: http://stackoverflow.com/questions/2993027/in-php-when-submitting-strings-to-the-db-should-i-take-care-of-illegal-characters/2995163#2995163

Answer 3

Various ways

$message = mysql_real_escape_string($message); 
$message = addslashes($message);

and when you are retrieving the content from the database use stripslashes() to bring the content back to its original self.

Answer 4

A whole hour of a question and nobody has mentioned that escaping strings is evil, and you should use prepared statements instead? Pretty effective way to eliminate SQL injection