August 2nd, 2003, 06:35 AM
mysql and characters
I'm writing program in C which writes _FILENAME_ to mysql database.
so I got variable (char) 'filename':
sprintf (&query, "INSERT INTO db (file) VALUES ('%s')", filename);
Then mysql is executing this query, it returns syntax error, becouse query have " ' " character.
OR in mysql it appears as:
Mysql ', \ symbols reads as control characters, so I need replace them to \' and \\ ?
* Does anyone have fast plain C function to replace these symbols ?
* Can I solve this problem by changing mysql query?
I am using gcc on linux.
August 2nd, 2003, 06:37 AM
MySQL has a fast function to replace problem characters. It's mysql_real_escape_string, and it's documented in the API documentation.
All of the string data that you get from the user should be run through this function. Otherwise some wisenheimer can hijack your SQL query to do their own evil.
Articles and commentary on web development