[GospodinX]

Hi guys,
I store every question/answer in my mysql database(For admin-panel)
But when player insert some characters i get some errors

For example if I type

Код:

/ask I'm GospodinX

I will get error for ' character..So I don't know how to fix it.

Example of my insert into query

Код:

INSERT INTO logovi SET  `Staff`='%s', `Player`='%s',  `Question`='%s', `Answer`='%s', `date`=UNIX_TIMESTAMP()", GetName(playerid),GetName(id),text,Ask[id][pText]);

[Sew_Sumi]

Apparently from what I've read and seen on the forums, you should be using escaped strings for anything a user can put in if it's going to the database, as they could put in the ' ending the string, and then run a code after to wipe your database clean.


What you need to look at though is escaped characters and such things.

[iHollyZinhO]

You can use " character instead of ' character. For example in this SQL code:

Код:

printf("INSERT INTO logovi (`Staff`, `Player`, `Question`, `Answer`, `date`) VALUES (\"%s\", \"%s\", \"%s\", \"%s\", %d)", [parameters...]);