php& mysql help

[byrdman]

I have a quesiton.
I have a php page that strips out names and symbols from a stock feed we have. There are some stocks like "Macy's" and "McDonald's" that have the dreaded apostrophe, or single quote. When the name of that particular stock gets passed to the "$name" varible, it won't insert into mysql.
I saw posts to use mysql_real_escape_string, but that messes up names like Proctor & Gamble, with the ampersand in it. I also have tried the htmlspecialchars and htmlspecialchars_decode in php to no avail. Any pointers or links to help inserting an apostrophe into the mysql field?

[Void Main]

mysql_real_escape_string() or addslashes()/stripslashes() are not working for you?

[byrdman]

well, here is the snipit of code I have been messing with:

Code: Select all

 //pull the Name from rss
                                $start = $namesymbol_start;
                                $end = $namesymbol_end;
                                $namesymb = get_string_between($string, $start, $end);
                                $remove = "$start$namesymb$end";
                                //      preg_match("/^([\w\d\s\.]*)\(.*[A-z]:([\w]*)\)$/", $namesymb, $matches);
                                        preg_match("/^([-a-zA-Z0-9%,&;_\s\.]*)\(.*[A-z]:([\w]*)\)$/", $namesymb, $matches);
                                        $name = $matches[1];
                                        $symbol = $matches[2];
                                $string = str_replace ($remove, "" , $string);
                                $name = htmlspecialchars_decode($name);
                                //$name = htmlspecialchars($name, ENT_QUOTES);                         
                                $name = str_replace("&", '&',$name);
                                $name = str_replace("'", '`',$name);
//                              $name = str_replace("'", '&rsquo',$name);


The "//" are from me doing trial and error, so I am not sure if I need to replace those. The script is grabbing data from an XML doc and placing into a temp file where the "Macy's" get placed into. Its when it grabbing it out of the XML, running through the preg_match and assigning the name to $name from $matches[1]. I'm sure you knew that.

Then this code puts it into the db:

Code: Select all

//insert rss item into database store
//mysql_real_escape_string($name);
/*
$insert_query = "INSERT INTO $tablestocks (
        `symbol`,
        `name`,
        `price`,
        `change`,
        `pchange`
) VALUES (
        '$symbol',
        '$name',
        '$price',
        '$change',
        '$pchange')";

So I am not sure where I am going wrong. I have not done addslashes() or strip slashes() yet. I will have to look at the php book for that!

[byrdman]

Stupid me...I just realized that my preg_match wasn't even grabbing the text from the xml because of the apostrophe...
I changed:

Code: Select all

 preg_match("/^([-a-zA-Z0-9%,&;_\s\.]*)\(.*[A-z]:([\w]*)\)$/", $namesymb, $matches);

to

Code: Select all

 preg_match("/^([-a-zA-Z0-9%,&;'_\s\.]*)\(.*[A-z]:([\w]*)\)$/", $namesymb, $matches);

and it worked.

Once I started messing with addslashes() I realized that it wasn't even grabbing the text. Thanks for your help. All is good now!

[Void Main]

Another way:

Code: Select all

$name = mysql_real_escape_string($name);

$insert_query = "INSERT INTO $tablestocks (
        `symbol`,
        `name`,
        `price`,
        `change`,
        `pchange`
) VALUES (
        '$symbol',
        '$name',
        '$price',
        '$change',
        '$pchange')";

Manual page:

http://php.net/manual/en/function.mysql ... string.php