Replace apostrophe in PHP

When creating SQL statements, string values are delimited using apostrophes. So what happens when there is an apostrophe in the data you are trying to insert? A SQL error will occur if, for example, the value of a variable included an apostrophe. Because you do not know what the user will type in, you must assume they are entering all sorts of bad data.

To insert an apostrophe into the database using SQL you need to put two apostrophes in the text where you want just one. For example, to insert the phrase "what's it?" into a database, the SQL code looks like:

INSERT INTO mytable (phrases) VALUES ('what''s it?')

In PHP there is a string function which allows you to replace on the variable easily: str_replace This function replaces one value with another in a string. So before you insert data in the database you should replace all single apostrophes with double-apostrophes. For the example variable, the PHP code is:

$comment = str_replace("'","''",$comment);