[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 296
  • Last Modified:

What's wrong with this Select statement

I've run into a problem that I can't figure out.

My code is below. It works fine unless my event_category has an apostrophe in it. Then, while the code still fires, there won't be any data associated with that category. I can look in the database and see it, but it won't show up on my page.

What do I have to do in order to accommodate the apostrophe? For example, "Women's Ministry." There's something about "Women/'s Ministry" that's messing things up and I don't know what.

Thoughts?
<?php	
					$querystate = "select distinct event_category from calendar order by event_category";
					$resultstate = mysqli_query($cxn, $querystate)
					or die ("Couldn't execute query.");
				
					while ($row=mysqli_fetch_assoc($resultstate))
					{
					extract($row);
					$the_event_category = $event_category;
					?>
					<tr>
					<td colspan="3" bgcolor="blue">
					<font color="white"><?php echo stripslashes($the_event_category); ?></font>
					</td>
					</tr>
					<?php 						
					$bruce="select * from calendar where event_category = '$the_event_category' order by event_date";
					$bruce_query = mysqli_query($cxn, $bruce)
					or die("Couldn't execute query.");
					while($bruce_row = mysqli_fetch_assoc($bruce_query))
					{
					extract($bruce_row);
					?>
					<tr>
					<td>
					<?php echo date("m/d/y", strtotime($event_date)); ?>
					</td>
					<td>					
					<?php echo stripslashes($event_name); ?>
					</td>

Open in new window

0
brucegust
Asked:
brucegust
2 Solutions
 
Guy Hengel [angelIII / a3]Billing EngineerCommented:
change:
                              $bruce="select * from calendar where event_category = '$the_event_category' order by event_date";


into:

                              $bruce="select * from calendar where event_category = '" . mysql_real_escape_string($the_event_category) ."' order by event_date";
0
 
LFLFMCommented:
use two apostrophe's together.. example:
'this Paul''s string'  becomes:  <  this is Paul's string  >
this is done by replacing ' for '' in your string..
OR better yet, use mysql_real_escape_string($the_event_category).. its MUCH safer, you should always use it

example;
<?php
$tmpstr = mysql_real_escape_string($the_event_category)
$bruce="select * from calendar where event_category = '$mpstr' order by event_date";
					$bruce_query = mysqli_query($cxn, $bruce)

Open in new window

0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now