mySQL插入语法错误与引用

Question

I'm receive the following error below, I believe its do in part the quote that I have in the insert string 5'10 - (178cm) in which is passed by the $en['height'] variable. what's the best way to handle this error?

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '10 - (178cm)', m_btype = 'Rather Not Say' at line 12

this is the mysql insert:

m_height = '".$en['height']."',

table is set as:

varchar(30) latin1_swedish_ci

Answer 1

Your issue is that you must "escape" strings before inputting them into SQL queries. Not doing that will allow people to alter your query by inputting quotes. Example if I input the following string:

'; select * from users; --

Its possible to execute SQL that you did not intend. The solution is to escape:

m_height = '".mysql_real_escape_string($en['height'])."',

Or better yet use a more up to date method of querying mysql such as PDO or mysqli functions.

Edit I also think you have a more general syntax error. Try this:

m_height = "'".mysql_real_escape_string($en['height'])."'",