sql调用用这个字符做奇怪的事情：“[关闭]

Question

I have a form that auto calls information for products, it uses autocomplete to pull the product description when someone puts in the product name. When the form calls the data, sample data may look like this :

Samsung 40" HDTV Television

After the form is saved, and reloaded, the data loaded looks like this :

Samsung 40

Is there a way to mass edit my product descriptions to replace " with inch, or to make this not happen

Using SQL

Code sample of insert :

foreach (blabla)
$productName = mysqli_real_escape_string( $this->_con, trim( $invoice_detail['productName'] ) );
$query = "INSERT INTO invoice (`productName`) VALUES ('$productName')
mysqli_query($this->_con, $query);

Code sample of retrieve :

<td><input value="<?php echo isset($item['productName']) ? $item['productName']: ''; ?>" type="text" data-type="productName" name="data[InvoiceDetail][<?php echo $key;?>][productName]" id="itemName_<?php echo $key+1?>"></td>

Answer 1

you're not escaping html special symbols, your code:

echo isset($item['productName']) ? $item['productName']: '';

should look like this:

echo isset($item['productName']) ? htmlspecialchars($item['productName']) : '';