0

i tried to insert text to sql using php but i get an error because some words like: doesn't have a ' in it which interfere with the ' ' in the sql insert value. i get the text value from a php form and run it like this :

"UPDATE forums SET CreatorID = '$CreatorID' , ForumID = '$ForumID', ForumTitle = '$ForumTitle', ForumTag = '$ForumTag', ForumText = '$ForumText', ForumDate = '$ForumDate'
    where ForumID = $ForumID";
Amine Mo
  • 49
  • 4
  • 3
    Use prepared statements with parameters instead of substituting strings and this problem will go away. It also prevents SQL injection, which improves application security. – Barmar May 16 '22 at 16:41

0 Answers0