Okay so I have a form and php file that sends the form data to MYSQL. I understand that my SQL command interprets apostrophes as a closing syntax or something and won't insert them. However I have a string replace for all apostrophes. This seemed to work until I inserted the variables into html and tried inserthing them again. See below
$c1=$_POST['c1'];
$c1a=str_replace("'", "''", "$c1");
$report= '
<html>
<body>
<p align=\”left\”><strong>Comments:</strong></p>
<p align=\”left\”>
'.$c1a.'
<br>
</p></td><html> ';
When I try to insert $report into my sql it won't let it go, as if the string replace never took place. But I know it did because when I echo $report to test it, all the apostrophes are replaced. What's going on!
Also, I have tested multiple times and the insert works when my form data doesn't include an apostrophe.
You have to add backslashes before single quotes. You can use the function mysql_real_escape_string() (or mysqli_real_escape_string()) to do that.