Drupal SQL Injection Prevention and Apostrophe Processing in Forms

Question

in typical PHP applications, I used mysql_real_escape_string before I introduced SQL inserts. However, I cannot do this in Drupal, so I would need help. And without any function like this, user input with apostrophes violates my code.

Please offer.

thanks

My SQL is as follows:

$ sql = "INSERT INTO some_table (field1, field2) VALUES ('$ field1', '$ field2')";

db_query ($ SQL);

Answer 1

Wrap the table with {}.

Also, use the correct placeholder syntax to insert, for example,% d for numbers,% s for strings.

Here is the API function page:

http://api.drupal.org/api/function/db_query/6

Note that he has arguments.

Example:

db_query('INSERT INTO {tablename} (field1, field2) VALUES ("%s", "%s")', $field1, $field2);