search terms in a PHP query with apostrophes

Question

I've been looking through a bunch of topics but haven't found anything that works yet - or maybe it does, but I'm pretty new to PHP/MySQL, so maybe I'm just missing something.

I've got a page that allows users to type in the name of an item to look it up in the (MySQL) database. It then generates a table of results and displays those, and turns some of the data into links. The linked terms are then used as queries to search other fields of the database.

Everything works... except when one of the search terms contains an apostrophe. Obviously I want to prevent injection issues, but I also need to search with the apostrophes. Here's the code I have:

$query = mysql_real_escape_string($query);
$query = htmlspecialchars($query);
$queryentered = $query;
$query = strtolower($query);

And here's the URL that's it's passing to the query:

echo " from <a href='index.php?volume=".$results2['book']."' class='where'>"
.$results2['book']."</a>";

And the query:

$raw_results = mysql_query("SELECT * FROM $database1 WHERE $wh LIKE '%$query%'
ORDER BY displayname") or die(mysql_error());

What am I not encoding right? When I run a search, it displays "No results found for [search term]", where I'm getting \\' for any apostrophes.

Answer 1

This snippet is in exactly the wrong order:

$query = mysql_real_escape_string($query);
$query = htmlspecialchars($query);
$queryentered = $query;
$query = strtolower($query);

Escaping should be done last, right before the database query string concatenation. In this case it's irrelevant as strtolower does not undo the escaping. More severe is actually the HTML escaping, which does not belong in SQL context. Don't overwrite your main variable, instead:

$queryentered = htmlspecialchars($query);
$query = strtolower($query);
$query = mysql_real_escape_string($query);

The cumbersome database escaping, btw, is easy to avoid. Look into PDO and prepared statements .

Answer 2

I'd STRONGLY recommend using prepared statements and the PDO library.

• Really easy to learn
• Will make your question easier to solve
• Works with (most) any database
• Goes a long way to prevent the injection issues you mention
• Skill set will be applicable to other languages you may learn

All you have to do is write the query, then prepare a connection string (with the database type and details) and then fire off the query. An array of parameters is sent with the query, to decouple the data.

Helpful links:

http://net.tutsplus.com/tutorials/php/why-you-should-be-using-phps-pdo-for-database-access/

http://id1.php.net/pdo

Answer 3

problem is in this line:

$query = htmlspecialchars($query);

If you search for Death's book your final $query would be death\\'s book ! By removing htmlspecialchars your query would be fine!