使用单引号将数据添加到php mysql中

Question

This is my code:

$q=mysql_query("SELECT * FROM `table1` WHERE name like '%$searchText%'");

      while($e=mysql_fetch_assoc($q))

              //$output[]=$e;
              //echo $e['NAME'];
              {
              $name = $e['NAME'];
              $brand = $e['BRAND'];
              $category = $e['CATEGORY'];
              $query = "INSERT INTO table2 (brand, name, category) VALUES ('$brand', '$name', '$category')";
              $result = mysql_query($query) or die("Unable to insert because : " . mysql_error()); 
              }

Since in "BRAND", there may be some data like "First's Choice".
In this case, I cannot insert to database due to error.
How can I insert data that contain single quotes? Thx

Answer 1

you need to use mysql_real_escape_string on the value, which you should be doing anyway. That should properly escape your value for insertion.

$name = mysql_real_escape_string($e['NAME']);
$brand = mysql_real_escape_string($e['BRAND']);
$category = mysql_real_escape_string($e['CATEGORY']);
$query = "INSERT INTO table2 (brand, name, category) VALUES ('$brand', '$name', '$category')";