[thelist] PHP - Invalid Query

[Tab Alleman]

Rob Smith wrote:
> Hi list,
> 
> I'm getting an "invalid query" in the INSERT query below with PHP.
> Can you see anything that may cause it to barf:
> 
> Original:
> $sql = "INSERT INTO newsarchive (newssubject, newsarchivetext) VALUES
> ('" . $subject . "', '" . $message . "')";
> mysql_query($sql, $link) or die ("Invalid query");
> 
> Actual:
> INSERT INTO newsarchive (newssubject, newsarchivetext) VALUES ('Just
> a Quick Hello', 'Hi Everyone, My name is Rob and I built this
> Newsletter System. I've been having some difficulties with it lately
> and would like for you to respond to either me at my at addres.com  if
> you received this newsletter. Thank you so much, Rob p.s. See you
> later! 
> --------------------------------------------------------- Please
> reply to this message if you have questions. If you would like to
> unsubscribe from this mailing list click this link:
> http://www.mysite.com/unsubscribe.php?nid=1.')


You need to "escape" the apostrophe ("I've...") by doubling it
("I''ve...").  It's good practice to do this anytime you are inserting
dynamic text into your database.