special character into descrition field

El 24/09/2010 10:52, softwareEngineer escribió/wrote:
> Hi all,
> in order to manage the special character into descrition field (i.e.:
> "Description 1, sddsd'")
> the sql query returns an error about ' character. I have correct this
> query with
> this description : "Description 1, sddsd\'". It's the right way ? can i
> do better ?

If it's a query you're writing manually, it's just fine: that's the
syntax to escape special chars.

However, if the query is being fed automatically by a program, you
should use a better method than escaping charactered one by one.
Whatever language and library you are using, it sure has an escaping
mechanism, either quote functions or prepared statements.


--
-- http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
-- Mi sitio sobre programación web: http://borrame.com
-- Mi web de humor satinado: http://www.demogracia.com
--
 >> Stay informed about: special character into descrition field 

The query is :

--> INSERT INTO device SET id = 26, configuration = 14, communication = 40,
description = 'SCORZE' 297';

It is generated by automated process written in c (through mySQL c api).

which is the correct way to handle this type of situations ? now, via code, i
replace into the "description"
string the ' char with \' . but IT'S ok ? is it ANSI SQL ?

many thanks.


Il 24/09/2010 11.19, Captain Paralytic ha scritto:
> On 24 Sep, 09:52, softwareEngineer wrote:
>> Hi all,
>> in order to manage the special character into descrition field (i.e.:
>> "Description 1, sddsd'")
>> the sql query returns an error about ' character. I have correct this query with
>> this description : "Description 1, sddsd\'". It's the right way ? can i do better ?
>>
>> many thanks.
>>
>> Onorato.
> Who can tell?
>
> You haven't shown us the query.
>
> You haven't shown us the error message.
 >> Stay informed about: special character into descrition field 

On 9/24/2010 11:37 AM, softwareEngineer wrote:
> Il 24/09/2010 11.19, Captain Paralytic ha scritto:
>> On 24 Sep, 09:52, softwareEngineer wrote:
>>> Hi all,
>>> in order to manage the special character into descrition field (i.e.:
>>> "Description 1, sddsd'")
>>> the sql query returns an error about ' character. I have correct this
>>> query with
>>> this description : "Description 1, sddsd\'". It's the right way ? can
>>> i do better ?
>>>
>>> many thanks.
>>>
>>> Onorato.
>> Who can tell?
>>
>> You haven't shown us the query.
>>
>> You haven't shown us the error message.
>
>
> The query is :
>
> --> INSERT INTO device SET id = 26, configuration = 14, communication =
> 40, description = 'SCORZE' 297';
>
> It is generated by automated process written in c (through mySQL c
> api).
>
> which is the correct way to handle this type of situations ? now, via
> code, i replace into the "description"
> string the ' char with \' . but IT'S ok ? is it ANSI SQL ?
>
> many thanks.
>
>
<top posting fixed>

Look at mysql_real_escape_string() - that's what it's there for, and
it's a lot safer than just using a "\'" - i.e. it's charset aware and
will catch ALL the potential problems in the current charset.

P.S. Please don't to post. Thanks.


--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex DeleteThis @attglobal.net
==================
 >> Stay informed about: special character into descrition field 

On 2010-09-24 17:37, softwareEngineer wrote:
>
> The query is :
>
> --> INSERT INTO device SET id = 26, configuration = 14, communication = 40,
> description = 'SCORZE' 297';
>
> It is generated by automated process written in c (through mySQL c api).
>
> which is the correct way to handle this type of situations ? now, via code, i
> replace into the "description"
> string the ' char with \' . but IT'S ok ? is it ANSI SQL ?
>

ANSI SQL is:

... description = 'SCORZE'' 297'

As others have mentioned in this thread, there are functions in your
host language that can handle this.

/Lennart

[...]
 >> Stay informed about: special character into descrition field