Surnames with quotes breaking SQL query, how to fix this? [duplicate]

This question already has answers here: Closed 11 years ago.

Possible Duplicate:

apostrophes are breaking my mysql query in PHP

I asked a friend to test my site and his surname had a ' . O'Rourke so I got error with syntax around Rourke. Obviously caused by the apostrophe.

How do I prevent this from happening so he can register to my si开发者_开发问答te?

$name = $user_profile[name];

mysql_select_db("gamedb", $con);

$sql="INSERT IGNORE INTO Users (FID, Name, Date) VALUES ('$fid','$name',NOW())";

Does escaping solve the issue? I couldn't actually try escaping it since the name is retrieved from the usr facebook account.

Thanks

---

Use Prepared statements. That'll automatically handle input escaping. The current INSERT is open to a SQL injection attack. Check out mysqli_stmt::prepare()

---

Use mysql_real_escape_string() for the variables

$sql = "INSERT IGNORE INTO Users (
          FID, 
          Name, 
          Date
        ) VALUES (
          '" . mysql_real_escape_string($fid) . "',
          '" . mysql_real_escape_string($name) . "',
          NOW()
        )";

---

Escape the string with:

$name = mysql_escape_string($user_profile[name]);

This prevent sql injection

---

you should use mysql_real_escape_string($sql) before you insert a row

---

you need to use mysql_real_escape_string function in php. You can see the details here http://php.net/manual/en/function.mysql-real-escape-string.php