尝试更新段落后出现 MYSQL 错误

Question

我有一个非常具体的问题，我找不到问题。我尝试更新一些文本，但出现错误:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '= Easter in Corfu is considered to be the most magnificent celebration in Gree' at line 1

我的代码:

$arr = explode("|", $id, 2);
$id = $arr[0];
$part = $arr[1];                                                // in which part of a splited paragraph currently we are
$row = mysql_fetch_array(mysql_query("SELECT * FROM paragraph WHERE id=$id")) or die(mysql_error());    
$search = 'insertphotos';                                       // the string to search for     
$string = $row['text_content'];                                 // the string to search
$repetition = substr_count($string, $search);                   // how many insertphotos exist in paragraph
if ($repetition > $part){   
    if ($part > 1)
        $offset = $part - 1;                                    // how many times to search for word insertphotos
    else
        $offset = $part;
    $start = strposOffset($search, $string, $offset) + 13;      // find position of '$offset' occurance of search string
    $offset++;
    $end = strposOffset($search, $string, $offset) - $start - 1;
    $string = substr_replace($string, $value, $start, $end);
}else if ($repetition == $part){
    $offset = $part;                                        // how many times to search for word insertphotos
    $start = strposOffset($search, $string, $offset) + 13;      // find position of '$offset' occurance of search string
    $string = substr_replace($string, $value, $start, strlen($string)); 
}else
    $string = "<p>".$value."</p>";
//$value = "<p>".$value."</p>";
mysql_query("UPDATE paragraph SET text_content=".$string." WHERE id='$id'") or die(mysql_error());  
//mysql_query("INSERT INTO paragraph (header, text_content, menu_id, sequence) VALUES('<h2>Bella Vista Hotel h2 - Please Change Me</h2>', $string, '15', '2')") or die(mysql_error());
mysql_close($link);     
//echo "INSERT PHOTOS REPEATS " .$repetition ." ID =".$id ." PART = ".$part ." WE SEARCH, START AT " .$start ." FINISH AT " .$end ." SEARCH FOR OFFSET = " .$offset ." FINAL STRING " .$string;
echo $string;

每个变量都有效，我尝试回显，没有任何问题。如果文本中只有一个 insertphotos(或零个)，它就可以工作。虽然我有不止一个，但我得到了这个错误。我不知道为什么？

Answer 1

您的文本字符串未被引用。

mysql_query("UPDATE paragraph SET text_content='".mysql_real_escape_string($string)."' WHERE id='$id'") or die(mysql_error());

您还应该转义您的输入:http://php.net/manual/en/function.mysql-real-escape-string.php