Trouble with mysql_real_escape_string

PHP
1

Code I have used on other pages flawlessly is now giving me fits. Here it is:

if ($testimonialTitle) {
	$testimonialTitle = "'" . mysql_real_escape_string($testimonialTitle) . "'";
} else {
	$testimonialTitle = "NULL";
}

Here is the query I use:

$approveQuery = "

UPDATE
	testimonies 
SET 
	title 	= $testimonialTitle,
WHERE 
	tID = $tID
";

Here is the error I get:

Error: (2006) MySQL server has gone away

I save the query to a session variable so I can try to debug. Here is what it is:

UPDATE
	testimonies 
SET 
	title	= '\'\\\'\\\\\\\'\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\\\\\\.....'
WHERE 
	tID = 10350

I truncated the slashes because there are thousands of them. Can someone see something that I am obviously overlooking?

Thanks!

2

Your MySQL connection is being retired due to the insert data being too large, causing a timeout. You need to find out why your real_escape is behaving that way(all the slashes).

What version of PHP and MySQL are you using? Also, why are you using the mysql extension and not mysqli or PDO?

3

Yes, I have poured over this code for several hours, and I’m at a loss as to why all these slashes are being inserted. Any ideas? I am not currently using mysql or PDO simply because I haven’t had the time to learn this new method. It’s on the list, but not sure how soon I will get to it. Too many fires to put out…

Thanks!

4

IMHO time to move it up the list.

Rather than spend time and effort debugging old deprecated code that will soon need to be rewritten anyway, spend the time converting it to mysqli_ or PDO and not only may you find that the problem is resolved, but you’ll be in a better place knowing current practice.

1 Like
5

Converting to mysqli is stupid easy and can be done in very little time. That would be my suggestion. The MySQL extension hasn’t been developed in over half a decade, has been deprecated for years and will be flat out removed from PHP in v.7.

This should be the fire you’re putting out.

2 Likes
6

That’s called escaping and is necessary when you have code and data jumbled together.

Both of the current methods of accessing mySQL databases allow you to keep the SQL code separate from the data by using prepare statements - which eliminates the need for escaping. The antiquated and soon to be removed method you are currently using doesn’t have that option.

1 Like
7

So is it recommended that I research mysqli or PDO?

Thank you.

8

I think going to mysqli_ may be easier as a first step. But going to PDO would have longer term benefit.

That is, mysqli_ isn’t all that different from mysql_ but has “extras” that can be, but don’t necessarily need to be used.
PDO is OOP so if you aren’t comfortable with OOP the learning curve would be a bit steeper.

1 Like
9

Let’s put it a bit more bluntly;

PHP 5.5 Deprecated the mysql_ library in it’s entirity, with an eye to remove it completely in PHP 7 (the RFC vote passed). So, it’s time to move that research priority up the queue a bit. It’s not just recommended, it’s quickly going to be Required.

1 Like
10

SitePoint have an article that covers migrating over from the old mysql_* extension over to PDO http://www.sitepoint.com/migrate-from-the-mysql-extension-to-pdo/

11

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.