mysql_real_escape_string

Posted on 16th Feb 2014 07:03 pm by admin

Let me preface this that I am very much a PHP noob, but I have some SQL training (not necessarily MySQL, we used the Microsoft variety in school). I have a weird problem, I'm trying to create a script that will take a RSS feed and import it to a MySQL database. It worked well when I was only bringing in 10 items in the feed at a time, but when I opened it up to a larger set of items it freaks out. I think it has to do with the data not being very "clean". Meaning the data has a lot of single and double quotes and what not. As you'll see in my code I've tried to fix this by using mysql_real_escape_string(), but it still get's hung up for some reason. Here's a look at my code:
Code: <?php include('rss_fetch.inc');
define('MAGPIE_FETCH_TIME_OUT', 200);

function safe($value){
return mysql_real_escape_string($value);
}

// Set error reporting for this
ini_set('display_errors',1);
error_reporting(E_ALL);

// Fetch RSS feed

$rss = fetch_rss('feedurl');



if ($rss) {
// Split the array
$items = array_slice($rss->items,0);

// Cycle through each item and echo
foreach ($items as $item)
{
$con = mysql_connect("server","uname","pword");
if (!$con)
{
die('MySQL could not connect: ' . mysql_error());
}

mysql_select_db("rsstomysql", $con);


$sql="INSERT INTO `opportunities` (`opp_id`, `opp_title`, `opp_link`, `opp_desc`, `opp_provider`, `opp_startdate`, `opp_enddate`, `opp_location_name`, `opp_categories`, `opp_openended`, `opp_sponsororg`, `opp_starttime`, `opp_endtime`, `opp_contactemail`, `opp_contactphone`, `opp_contactname`)
VALUES('".$item['fp']['id']."', '".safe($item['title'])."', '".$item['link']."', '".safe($item['description'])."', '".$item['fp']['provider']."', '".$item['fp']['startdate']."', '".$item['fp']['enddate']."', '".$item['fp']['location_name']."', '".$item['fp']['categories']."', '".$item['fp']['openended']."', '".$item['fp']['sponsoringorganizationname']."', '".$item['fp']['starttime']."', '".$item['fp']['endtime']."', '".$item['fp']['contactemail']."', '".$item['fp']['contactphone']."', '".$item['fp']['contactname']."')
ON DUPLICATE KEY UPDATE `opp_title` = '".$item['title']."';";
if (!mysql_query($sql,$con))
{
die('MySQL Error: ' .mysql_errno() .mysql_error());
}
echo "Records added";
mysql_close($con);
}
}
else
{
echo '<h2>Magpie Error:</h2><p>'.magpie_error().'</p>';
}
// Restore original error reporting value
@ini_restore('error_reporting');
?>This is the error I'm getting:
QuoteMySQL Error: 1064You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Stop Modern Day Slavery'' at line 3The 'Stop Modern Day Slavery" is in one of the title fields in the feed. I have used mysql_real_escape_string() on the title field, but it does not seem to have any effect. Does anyone have any ideas? I've also used addslashes() and it does the same thing...

Your Answer:

Login to answer

Other forums

What do you call the "token" thing?
You know how some sites have links that run on tokens? Tokens are links that only stay alive for a c

Need PHP help... have all the elements... just need help putting them together :
Hey Guys,

I was wondering if someone could help me. I am doing a website for a client which

PHP5 - Verifying a secure mail is secure
I need to send an e-mail from a form to a external department and because it contains personal custo

Easy administration on MySQL databases
My website is database driven and I am very tired of manually making queries to my tables in order t

Problem displaying "scraped" XML data
I'm basicly having trouble displaying XML data scraped from an URL using cURL.

What the code

Pulling out some result data from MYSQL
Hey Guys,

I've built a PHP page that has a for just imagine something like registration form

Need help adding a timestamp to my filename/variable
Hello,

I'm kind of stupid when it comes to php and I need a tiny bit of help. I've got a f

for some reason mysql query not working, not inserting, please check it out
This code is not inserting anything into my db, don't know why, the $_SESSION variable does contain

Include with Parameters
In a particular page I would like to include a file that requires $_GET parameters.

when I go

ob_ dynamic content
i was wondering about the potential to use ob to create a <div then remove it when the page