mysql error when I enter the apostrophe in the text area

[pk698]

Hello.

my script gives a mysql error when I enter the apostrophe ' in a text area. does anyone know what could be causing it?

I did not write the script, but someone else did.

thanks.

[ceaser]

Whoever wrote the script didnt program the form content to be cleaned before being sent to the database. You have to escape the apostrophe and quotes with a \.

IE:
\' - html substitute = '
\" - html substitute = "
\n = newline
\t = tab

[Pazeh]

Originally Posted by pk698

Hello.

my script gives a mysql error when I enter the apostrophe ' in a text area. does anyone know what could be causing it?

I did not write the script, but someone else did.

thanks.

I say you are in a serious problem!! Your database is totally vulnerable to SQL injection attack, very very easily!! Especially if your visitors do have access to that text area & can enter some text.

Never ever pass any variable that a user enters to DB without first sterilizing it!

There are a dozen way to sterilize, clean a user input do google for "sql injection" and "sterilize sql" for more info.

But remember to do the fix asap!

[pk698]

A friend wrote this for me, I don't know any coding. anyone willing to help me out?

[Pazeh]

so the textarea is accessible by the visitors? if so, do PM me the url & I'll have a look

[pk698]

I think I will just go ahead and get a programmer to recode it. Would be easier than trying to fix all the bugs.