Posted by Alain Reguera Delgado on 10/20/28 11:24

you could try:

1. get all form variables into an array
2. validate values
3. convert all values into entities using htmlentities()
4. build sql query (do some tests 'til get it right)
5. execute the built query (with proper db function)

by now, commas aren't a problem, they are limited between sql query's
quotes. If some quotes are inserted as value they are previously
converted to its entities and do not break the sql query.

as previously said in this thread, the problem is on quoting and maybe
on converting the values to entities, to prevent some quote break the
sql structure.

[Back to original message]