views:

27

answers:

1

i want to store more than 1000 character in database i use mysql database.

when i insert 50-100 character the code run successfully.but when i insert 1000 character it not inserted. even it also not give error.

when i use similar insert query in myphpAdmin, the query run successfully. this is query

first two fields are varchar & last field is Longtext

INSERT INTO news (headline,date,discription)
VALUES ("hi","date","A crumbling pitch and some resurgent Indian bowling have set up a gripping deciding Test with the series lead threatening to slip out of the hosts' grasp. India had snuck ahead at the end of the third day, but were dominant by lunch on the fourth as Pragyan Ojha and Amit Mishra ran through the Sri Lankan batting. Thilan Samaraweera, the centurion from the first innings, held firm and is key to Sri Lanka's fortunes as they try to build a lead that is competitive enough to give their spinners a chance. ")

this run successfully in myphpadmin

but when i try to run in php then it cant run

here php code

 $insert = "INSERT INTO news (headline,date,discription)
 VALUES ('".$_POST['headline']."','".$_POST['date5']."','".$_POST['discription']."')";
 $add_news = mysql_query($insert);

& this code is use in tag

<textarea rows="2" cols="2" style="overflow: scroll; height: 90px; width: 635px;" name="discription"></textarea>
+2  A: 

Use the mysql_real_escape_string function before your string variables eg:

mysql_real_escape_string($_POST['discription'])

This could be most likely because the text contains single quotes which should be escaped.

mysql_real_escape_string — Escapes special characters in a string for use in an SQL statement

Your code should look like this:

$headline = mysql_real_escape_string($_POST['headline']);
$description= mysql_real_escape_string($_POST['discription']);
$date= mysql_real_escape_string($_POST['date5']);

$insert = "INSERT INTO news (headline,date,discription) VALUES ('".$headline."','".$date."','".$description."')";
$add_news = mysql_query($insert) or die(mysql_error());

Note that addition of or die(mysql_error() at the end, this would tell you if there is any error in the query itself.

Sarfraz
hey thanks its workthank you very much
Pratikg88
@Pratikg88: You are welcome...
Sarfraz
Also make sure you are catching errors somehow, because I saw (Sri Lanka's) word in your query, and if you didn't escape it it would certainly give an error.
Centurion
@Pratikg88 Note that addition of `or die(mysql_error())` at the end, this would reveal **very sensitive information** to a malicious user. use `or trigger_error(mysql_error().$insert)` statement instead and turn displaying errors off on the production site
Col. Shrapnel
@Col. Shrapnel: I made him add it just to check what could be the problem in query and yes agreed it should be disabled after getting live (assumed) or using outputting the less sensitive message like you said.
Sarfraz
hey col. shrapnel thanks for advice
Pratikg88
error tracking shouldn't be disabled after getting live. actually, possible error message is 1000 times more important on a live site. that's why trigger_error() should be always used.
Col. Shrapnel
@Col. Shrapnel: Agreed again.
Sarfraz