hello everyone :) i'm having a problem that's really starting to annoy me. it's probably the fact that i'm really tired and overlooking something stupid..haha, i need a set of clean eyes..

what i'm doing is basically taking the smilie code and writing that into a news/comments script...here's the script...


$changing = $_POST[story];
$gone = strip_tags($changing);
$bbsmile = array(":)", ":(", ":o", ":D", ";)", ":p", ":cool:", ":rolleyes:", ":mad:", ":eek:", ":confused:", ":amazed:", ":angry:", ":bald:", ":beard:","\n");
$bbsmiletohtml = array("<img src='images/smilies/happy.gif'>", "<img src='images/smilies/sad.gif'>", "<img src='images/smilies/embaressed.gif'>", "<img src='images/smilies/super_happy.gif'>", "<img src='images/smilies/wink.gif'>", "<img src='images/smilies/tounge.gif'>", "<img src='images/smilies/cool.gif'>", "<img src='images/smilies/rolleyes.gif'>", "<img src='images/smilies/mad.gif'>", "<img src='images/smilies/eek.gif'>", "<img src='images/smilies/confused.gif'>", "<img src='images/smilies/amazed.gif'>", "<img src='images/smilies/angry.gif'>", "<img src='images/smilies/bald.gif'>", "<img src='images/smilies/beard.gif'>", "<br>");
$changed = str_replace($bbsmile, $bbsmiletohtml, $gone);
$slashgone = stripslashes($changed);
$ip = getenv("REMOTE_ADDR");
if ($_POST[password] == "**************"){
$user = "user";
$password = "pass";
$icondb = "db";
mysql_connect(localhost,$user,$password) or die("no connection");
mysql_select_db($icondb) or die("cant grab database");
$query = ("INSERT INTO news VALUES('','$_POST[by]','$_POST[date]','$_POST[title]', '$slashgone', '$_POST[icon]')") or die ("query error");
mysql_query($query) or die ("can not execute query:<br>".mysql_error());

the problem that i'm having is the $slashgone, when i input that into the insert scipt and a char such as , ' " ) is entered within that script, it thinks i'm sending that as part of the query and stops running and errors out. when i send the $_POST[story] in the insert string i can send any chars i want and no problems :mad: anyone shed some light? thanks in advance!

Well, first of all, you can tell by the syntax highlighting that your " " are not correct. You can't start a string with " and then not escape any " in it. Simplified example:


<?php

echo "Hello, this is a "string";
echo 'Hello, this is a "string"';
?>


In addition, you might want to use mysql_escape_string()