doesnt encode apostrophes?

Hello,

FCKeditor: 2.5 - php

it seems that any apostrophes are not being encoded. For example, If I type some text in MSWord with an apostrophe, and then paste it into the editor its fine. Probably because word already encoded the apostrophe. The problem is, if I am typing directly into the editor and use an apostrophe.. it is not encoded, thus throwing sql syntax errors at me. Is it true that there is no real html entity for an apostrophe? How can I modify the code or implement a work around for this apostrophe problem?

Thank you in advance

Mon, 12/03/2007 - 23:38

alfonsoml

Joined: 31/12/2006

Posts: 3735

Re: doesnt encode apostrophes?

If it is giving you sql errors, then you have a SQL Injection problem. I hope that you don't have valuable information in that server.

Tue, 12/04/2007 - 21:34

nottiman

Joined: 03/12/2007

Posts: 2

Re: doesnt encode apostrophes?

The sql code inserts fine without an apostrophe. But when added, there is an insertion error because it interprets the apostrophe...

The problem is that fckeditor isnt encoding the apostrophe.

Mon, 06/02/2008 - 21:14

c#ristian

Joined: 02/06/2008

Posts: 1

Re: doesnt encode apostrophes?

y entonces??

and so???

How can we to use apostrophes in the FCKEditor content???

Mon, 06/02/2008 - 22:28

a.m.

Joined: 20/04/2008

Posts: 256

Re: doesnt encode apostrophes?

As alfonsoml noted earlier, your application is vulnerable to SQL injection attacks. Relying on the client side application, such as FCKeditor, for such encoding is a very naive approach and will cost you your server as soon as somebody figures out that it is vulnerable. You have to encode any input that reaches the database or use SQL parameter binding, which is a better method of handling SQL data.