php - Strip Out All Unwanted Characters -

i using following code strip out unwanted characters not stripping out , throwing mysql error:

    $commentmessage = strip_tags($commentmessage);     $commentmessage = htmlentities($commentmessage, ent_quotes); 

what code use strip out might cause mysql error?

the message receiving is:

error message: sqlstate[42000]: syntax error or access violation: 1064 have error in sql syntax; check manual corresponds mysql server version right syntax use near 'omg thats one". 1 of logo's liked 1049859 f' @ line 2**

evidently you're building query so:

$query = "insert foo values ('$bar')"; 

which breaking because text of $bar contains single quotes. '

no. *hits rolled-up newspaper* bad developer.

i could throw string escaping function, or show right like:

$bar = "i problematic string!'; drop table users -- " $query = "insert foo values (?)"; $stmt = $dbh->prepare($query); $stmt->execute(array($bar)); 

or:

$bar = "i problematic string!'; drop table users -- " $query = "insert foo values (:bar)"; $stmt = $dbh->prepare($query); $stmt->execute(array('bar'=>$bar)); 

when prepare query php/pdo/mysql , pre-agree on types placeholders are. strings treated strings without need escaping characters. both prevents rogue single quotes breaking query, , protect sql injection attacks.

you can re-use prepared statements increase performance: [relative un-prepared statements since sql needs parsed once, rather once per query]

$query = "insert foo values (?)"; $stmt = $dbh->prepare($query); foreach( $bars $bar ) {   $stmt->execute(array($bar)); }