（PHP / MYSQL）插入大值，无超时或错误时，Insert Into将不起作用

Question

I'm working on an AS3 program using flash; in the program, you enter your Username and Password and pick a deck of cards to register; When the register button is clicked, flash sends the username, password, and a long string from the deck of cards, which can reach over 1 MB long (but at the moment, it's only 1 KB long).

To do this, I use the INSERT INTO method. This is my code:

<?php 

/*
connect to database
*/

include "connect.php";

/*
create POST vars to receive data from flash
*/

$username = $_POST['username'];
$password = $_POST['password'];

$sdTrunkest = $_POST['sdTrunk'];


$sql = "INSERT INTO users (username, password, Trunk) VALUES ('$username', '$password', '$sdTrunkest')";
mysql_query($sql); 
exit("result_message=Success");
?>

When I run this code while $sdTrunkest is about maybe 100 Bytes long, it runs fine and registers. But when I try running it when $sdTrunkest is about 1 KB, it simply "pretends that it never saw" the INSERT INTO line. It doesn't give me a timeout error, and even so I tried using ini_set('max_execution_time', 0); , but it didn't change. In fact, it doesn't give me any errors at all. Is INSERT INTO unable to handle long text? And is there a way to fix this?

Thank you in advance ^^

Answer 1

I found the problem. It had little to do with that mysql_connect error, but I might as well change to mysqli to avoid other errors. Anyways, the problem was with the string itself; Not in its size, but in its contents. One of the cards' names had an apostrophe, which is probably what messed things up. I removed the apostrophe, copied the text and pasted it multiple times to increase the size, and it still worked perfectly.

I guess the reason why this question is asked so frequently is because the more text you add, the more likely you are to make a mistake.

Thank you very much to everyone who commented ^^

Answer 2

Yes, that is typically referred to as sanitizing inputs, and was my first comment. There are several ways to sanitize, but the easiest is to understand is to use mysql_real_escape_string ( http://www.php.net/manual/en/function.mysql-real-escape-string.php )