mysql_real_escape_string and mysql_escape_string don't work?

PHP
1

I am trying to post content to a database table.
Specifically this article:End to Japan nuke crisis is years, a fortune away - Yahoo! News

But mysql_real_escape_string and mysql_escape_string are only able to save the first one word “Tokyo”.

What could I be doing wrong or missing ?


$_POST[articlebody] = mysql_real_escape_string($_POST[articlebody]);


$insertseed = "INSERT INTO table (articlebody) VALUES ('$_POST[articlebody]')";
mysql_query($insertseed) or die("Couldn't execute query");
2

Is it choking after the first word, or after the space after the first word?

<div class="yn-story-content">
                <p>TOKYO &ndash; Once Japan's leaky nuclear complex stops spewing radiation and its reactors cool down, making the site safe and removing the ruined equipment is going to be a messy ordeal that could take decades and cost hundreds of millions of dollars.</p>

Or are you getting it from a feed, maybe inside CDATA?

3

I am cutting and pasting it into a textarea, then posting it via $_POST to a mysql database.

It fails after the first dash…

4

Only a guess, but I’m thinking it probably has something to do with the MySQL charset. I would have thought that MySQL would mess the bytes and show “funny characters” but maybe it chokes and stops the INSERT/UPDATE when a character is outside of the charset range?

5

that should be fairly easy to test, yes? :slight_smile:

6

How many characters have you allowed to be input into the relevant database field…? If it’s only five then it will only save “Tokyo”.

7

The field is a longtext type using utf8_general_ci

8

Do an echo of $insertseed. What do you see?

If that is ok, how did you check the data in the database? phpMyAdmin? Another script that retrieves and displays the data?

9

Can you post the entire form script and form handling script?

10

yes
I think that’s what it is…

When I change the char set to Binary, all the data is saved…
But when I switch back to UTF8, only “Tokyo” is saved.

Wordpress also uses UTF8 but but it is able to save the article, my guess is that it converts the data into a saveable format.

I don’t know how wordpress does this conversion yet.

11

yes, i used phpmyadmin.
Also used PhpMyAadmin to change the char set

12

SQL


CREATE TABLE `articletable` (
  `id` bigint(20) NOT NULL auto_increment,
  `articlebody` longtext NOT NULL,
  UNIQUE KEY `id` (`id`)
) ENGINE=MyISAM  DEFAULT CHARSET=utf8 AUTO_INCREMENT=3 ;





     include("database.php");  // your database data goes here
    @$dbcon = mysql_connect(DB_HOST,DB_USER,DB_PASSWORD);
    @$dmotorsConn = mysql_select_db (DB_NAME, $dbcon);    




if($_POST[articlebody] !="")
    {
            $insertseed = "INSERT INTO articletable (articlebody) VALUES ('$_POST[articlebody]')";
            mysql_query($insertseed) or die("Couldn't execute query &lt;br&gt;  $insertseed");
    }
                    

echo "&lt;form method=post&gt;";

$combine  .= "&lt;h3&gt;&lt;font color=green&gt; Step 1:&lt;/font&gt; Create New Campaign &lt;/h3&gt;";

$combine  .= "
Try saving this article: http://news.yahoo.com/s/ap/20110409/ap_on_re_us/as_japan_earthquake_nuclear_endgame
&lt;table&gt;
";

$combine  .= "
&lt;tr&gt;
    &lt;td&gt;    
            &lt;strong&gt;Article Body &lt;/strong&gt;
    &lt;/td&gt;
    &lt;td&gt;    
            &lt;textarea cols=80 rows=7 name=\\"articlebody\\"&gt;$cleancontent&lt;/textarea&gt;        
    &lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
    &lt;td&gt;    
&nbsp;
    &lt;/td&gt;
    &lt;td&gt;    
&lt;input type=submit value=\\"save it\\"&gt;
    &lt;/td&gt;
&lt;/tr&gt;

&lt;/table&gt;
";


        
    $combine  .= "&lt;/form&gt;";

echo $combine;
13

That’s not the entire script is it? You didn’t even use mysql_real_escape_string() in that script, and you are populating the textarea with the $cleancontent variable which is not defined in your script. What is $cleancontent supposed to be?

14

$cleancontent was left there by accident. ( You can ignore it )
I can’t post the entire script. So I simplified it.
The same error occurs with other scripts I am using.

I’m quite sure its has something to do with the mysql charset.
Wordpress is able to save the entire article content using the same mysql charset.
Obviously Wordpress surely processes the content much better.

15

If you use that code snippet that you posted, and mysql_real_escape_string() and remove the $cleancontent variable does it work for you? I tried it and it works fine.

16

Yes, your right, it’s working :slight_smile:

I see what the error is now.
My external database connection file had extra include files that were modifying the $_POST data. I rewrote a very simple database connection and everything is working just fine now.

So that solves it…

Thank You!

Sample php connection I used, instead of the complicated external database connection.



$dbhost = 'localhost';
$dbuser = 'xxxxxxx';
$dbpass = 'xxxxxxxxxxx';

$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die                      ('Error connecting to mysql');

$dbname = 'wordpress';
mysql_select_db($dbname);

Thanks to aamonkey, guido2004, Ethan-27, r937 and Mittineague and everyone else who took the time to look into this. I really appreciate it!

17

glad you got it working :slight_smile: