the net of double quota and single quota

[i33333]

old SQL statement:
$sql = "update cdb_posts set subject='$subject' where pid='$pid'";

a variable:
$backurl = "article_list.php?mode=" . $mode . "&clsid=" . $clsid. "&mp=". $mp;


i wanna modify the SQL statement and make the value of subject a URL:
$sql = "update cdb_posts set subject='<a href=' . '"' . 'article_list.php?mode=' . $mode . '&clsid=' . $clsid . '&mp=' . $mp . '"' where pid='$pid'";

error shown：
Parse error: parse error, unexpected T_CONSTANT_ENCAPSED_STRING


what to do? how should i write the SQL statement?

Thank U!

[i33333]

in order to debug:

// ----------- start ---------------
<?php
$mode = 1;
$clsid = 2;
$mp = 3;

$sql = "update cdb_posts set subject='<a href=' . '"' . 'article_list.php?mode=' . $mode . '&clsid=' . $clsid . '&mp=' . $mp . '"' where pid='$pid'";

echo $sql;

echo mysql_error();
?>
// ------------- end ---------------

Parse error: parse error, unexpected T_CONSTANT_ENCAPSED_STRING in /var/www/html/test.php on line 6

[GaryS]

Haven't tested the following... so proceed with caution!



$mode='the_mode';
$clsid ='the_clsid';
$mp= 'the_mp';
$pid=100;


$subject = '<a href="article_list.php?mode=' . $mode . '&clsid=' . $clsid . '&mp=' . $mp . '">';
echo '<textarea rows="5" cols="100">' . $subject .'</textarea>';


$sql = 'update cdb_posts set subject="' . addslashes($subject) . '" where pid=' . $pid;
echo '<textarea rows="5" cols="100">' . $sql .'</textarea>';


I've separated out the "subject" part: you want to make sure this is right before sticking it into the database. I've echoed it into a text area so that you can see what's going on (otherwise you'd have to "view source").


As you correctly spotted, the quotes in "subject" are going to cause a problem with sriting to the database: addslashes comes to the rescue by escaping the quotes. (Note that your magic quotes setting may make this step unnecessary).

Like I said, I haven't tested this, but I hope it gets you moving again.

[chazzy]

sql requires single quotes.

so make this change from the last post

$sql = "update cdb_posts set subject='" . addslashes($subject) . "' where pid=" . $pid;

[i33333]

Thank U, GaryS and chazzy!

i'll try it

[i33333]

now the case is:
------------------------

old statments：
$sql = "update cdb_posts set subject='$subject' where pid='$pid'";

after a modification:
$sql = "update cdb_posts set subject='<a href=\"article_list.php?mode=$mode&clsid=$clsid&mp=$mp\">$subject</a>' where pid='$pid'";
// this query statement can work normally

after another modification:
$sql = "update cdb_posts set subject='<a href=\"http://www.mydomainname/file.php?id=$id\">$subject</a>' where pid='$pid'";
// the problem of this statement is that all works normally except the variable $subject can't show normally


what to do?

[i33333]

up

everyone, any idea?

[GaryS]

There doesn't appear to be any material difference between the statements... so it's strange that the second one doesn't work. Have you tried echoing $subject just before to confirm that it still has the intended value?

[chazzy]

what does this mean?

// the problem of this statement is that all works normally except the variable $subject can't show normally

[i33333]

oh, Grays, i didn't echo $subject.
i'll try it tomorrow. Thank U!


chazzy, the following query can work well, i.e., it can show a link on the page, but the problem is the value of $subject cannot show normally on the page.
$sql = "update cdb_posts set subject='<a href=\"http://www.mydomainname/file.php?id=$id\">$subject</a>' where pid='$pid'";

[GaryS]

This is slightly off subject, but it's more usual to store link location and link value (your $subject) in separate fields in the database. Doing so would (a) remove the quotes complexity and (b) give you the flexibility to use the fields in other ways.

Just a thought!