views:

33

answers:

1

I have a couple of textarea fields, which get saved into the database as text. If the textarea input has a select, selected or selecting in it, the query fails. I've never encountered this before. Am I doing something wrong?

Here's the update query code as an example:

$Query = "UPDATE project SET status = '".mysql_real_escape_string($_REQUEST['status'])."', 
name = '".mysql_real_escape_string($_REQUEST['name'])."', 
summary = '".mysql_real_escape_string($_REQUEST['summary'])."', 
detail = '".mysql_real_escape_string($_REQUEST['detail'])."', 
category = '".mysql_real_escape_string($_REQUEST['category'])."', 
language = '".mysql_real_escape_string($_REQUEST['language'])."', 
updated_date = '".time()."', 
contact = '".mysql_real_escape_string($_REQUEST['contact'])."' 
WHERE id = '".mysql_real_escape_string($_REQUEST['id'])."'";

$mysqlobject->sql_query($Query);

function sql_query($sql="")
{
    if(empty($sql)) { return false; }
    if(empty($this->CONN)) { return false; }
    $conn = $this->CONN;
    $results = mysql_query($sql,$conn);
    if(!$results)
    {
        echo "<H2>Query went bad!</H2>\n";
        echo mysql_errno().":  ".mysql_error()."<P>";
       return false;
    }
    return $results;
}

The summary and detail fields take textarea data

+1  A: 

You've omitted the code to interact with the DB. Nevertheless my guess is you're using a function which naively stops on the word SELECT in attempt to protect against SQL injection.

jmz
updated question to include relevant code
gAMBOOKa