php - Save html on database and titles with quotes -
this question has answer here:
- how can prevent sql injection in php? 28 answers
if try save text on db i'm getting error.
lets this:
$name = "bob's pizzaria"; $description = "<b>tes, test</b>"; // color, size formats
when save database use this:
$a_name = mysql_real_escape_string($_request["name"]); $a_desc = mysql_real_escape_string($_request["description"]);
then insert database.
i error on $a_name
because there apostrophe ( ' )
and on description doesn't retain text format bold, color, size etc.
what best or right way this?
replace ' '
str_replace("'","'",$name);