php save html-code in phpmyadmin

Question

I have a little problem to save html-code in phpmyadmin.

Thats the html-code ($html_txt) which I would like to save in the sql-table. I get the code from an other sql-query.

An günstigen Tagen "Paradies" ist es dienlich.
Test/Test<br /><br />"Test"

And that is my query.

$id = 1;
$html = "'".$html_txt"'";
$sql = 'UPDATE table SET text = '.$html_txt.' WHERE id = '.$id.'';

That does not work. Any idea? I tried it also like this:

$id = 1;
$html_txt;
$sql = 'UPDATE table SET text = '.$html_txt.' WHERE id = '.$id.'';

Answer 1

You must escape the string statements before querying. Your query should be like the following:

$con = mysqli_connect("localhost","user","password","db");
$id = mysqli_real_escape_string($con, $id);
$html_txt = mysqli_real_escape_string($con, $html_txt); 
$sql = 'UPDATE table SET text = ' . $html_txt . ' WHERE id = ' . $id . '';

I die if I do not say:

1. Please use parameterized query
2. Please avoid using vulnerable sql statements.

Answer 2

use mysql_escape_string to support for html entities and may the text be the kwyword so use like this text

$id = 1;
$html =mysql_real_escape_string($html_txt);
$sql = 'UPDATE table SET `text` = '.$html.' WHERE id = '.$id.'';

Answer 3

This should be a comment - but it's a bit verbose.

It should be obvious to most PHP developers that the problem is lack of escaping of the HTML string, however that in itself is not a reason for this being a poor question.

You've not provided details of any attempt to investigate the problem yourself. "Doesn't work" is not a good description of what happenned - in this case the expected outcome is fairly obvious to me, but that's not always the case. I aslo know what the actual outcome would be - but you've not documented that either. In most occassions where code does not behave as expected, an error message will be reported somewhere - you should be looking for it. The DBMS would have returned a specific error message - which your code should poll - especially if you are running into problems.

If you had viewed the SQL you were sending (or included it in your post) this would also have helped diagnosis.

Answer 4

You should properly escape your HTML value. Though this solution is not optimal as it does not use parameterized queries (PDO, ....), try this:

$html = 'An g&uuml;nstigen Tagen "Paradies" ist es dienlich. Test/Test<br /><br />"Test"';
$id = 1;
$sql = 'UPDATE table SET text = '.mysql_real_escape_string($html).' WHERE id = '.$id.'';

Answer 5

i would suggest you use mySQli prepared statement, WHY : i think somewhere along the line your variable have funny characters that r messing up with your query..with prepared statements the query is send alone then after your variables are binded to it, pls check above code

$conn = new mysqli("localhost", "your username", "your pass", "your db");
$myString = "Your string here";
$id  = 1;

$insertDB = $conn->prepare("UPDATE table SET text = ? WHERE id = ?");
$insertDB->bind_param('si', $myString, $id); //bind data, type string and int 'si'
$insertDB->execute(); //execute your query
$conn->close(); //close connection