Help with string handling

[mooncat]

hello, great work on the guestbook, I really like it!

Just having a problem with apostrophes in the mysql code.  Im very new to mysql but I think

$comment = mysql_real_escape_string($rec['comment']);

might fix this but I dont know where to put it or if it'll work.

any help would be appreciated.

regards.

[mooncat]

Just to clarify the flex2 guestbook doesnt work with apostropes. The amfphp is here;

<?php
 include_once("inc_sql.php");
class guestbooking{
    var $dbhost = HOSTNAME;
    var $dbname = DATABASE;
    var $dbuser = USERNAME;
    var $dbpass = PASSWORD;

    function guestbooking(){
       $this->conn = mysql_pconnect($this->dbhost, $this->dbuser, $this->dbpass);
        mysql_select_db ($this->dbname);
    }

    function requestPost($which_id){
       return mysql_query("select nombre,comment,imagen,extraurl from guestbook where _id='$which_id'");
    }

    function sendTitles(){
       return mysql_query("select titulo from guestbook");
    }

    function sendComment($wname,$wtitle,$wcomment,$url,$extraurl){
       mysql_query("insert into guestbook (nombre,titulo,comment,imagen,extraurl) values ('$wname','$wtitle','$wcomment','$url','$extraurl')");
       return mysql_query("select titulo from guestbook");
    }

so is it possible to insert

$comment = mysql_real_escape_string($rec['comment']);

will this allow apostrophes? and how can i insert it? apologies for the lack of basic php skills.

[Ronald Wernecke]

before you insert it into mysql, you have to addslashes.

[mooncat]

thanks Ronald, if I were to add apostropes to the "comment" row. how far off am I with this?

<?php
 include_once("inc_sql.php");
class guestbooking{
    var $dbhost = HOSTNAME;
    var $dbname = DATABASE;
    var $dbuser = USERNAME;
    var $dbpass = PASSWORD;
   
    function guestbooking(){
       $this->conn = mysql_pconnect($this->dbhost, $this->dbuser, $this->dbpass);
        mysql_select_db ($this->dbname);
    }

    function requestPost($which_id){
       return mysql_query("select nombre,comment,imagen,extraurl from guestbook where _id='$which_id'");
    }

    function sendTitles(){
       return mysql_query("select titulo from guestbook");
    }

    function sendComment($wname,$wtitle,$wcomment,$url,$extraurl){
       mysql_query("insert into guestbook (nombre,titulo,comment,imagen,extraurl) values ('$wname','$wtitle','$wcomment','$url','$extraurl')");
       return mysql_query("select titulo from guestbook");
    }
    function InsertString($wcomment)
        $st = addslashes($wcomment);
    }
}

I apreciate any time you can give to this.