ColumnOne ColumnTwo ColumnThree Columnfour Columnfive ColumnSix one two three four 0 \'Button Here\'
As you can se
Change your code into this to make it secure and functional:
Note that you don't need to insert an id
into the table. If you have an autoincrement field id
than MySQL will autocreate an id for you.
mysql_real_escape_string()
escapes values for you. Always surround your $var
in the query with '
single quotes or mysql_real_escape_string()
will not work!
And never use it for column/table or database names, only for values.
See: these questions for more info:
SQL injection in general: How does the SQL injection from the "Bobby Tables" XKCD comic work?
protecting against SQL injection when using dynamic table names: How to prevent SQL injection with dynamic tablenames?