https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database Gravity Support Forums Topic: Using mysqli_real_escape_string with gform_after_submission and a mySQL database en-US Sat, 04 Apr 2026 22:01:19 +0000 http://bbpress.org/?v=1.0.1 q https://legacy.forums.gravityhelp.com/search.php https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database#post-360257 Wed, 03 Jul 2013 15:22:25 +0000 Richard Vav 360257@https://legacy.forums.gravityhelp.com/ <p>Andrew, thanks for sharing. </p> https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database#post-360247 Wed, 03 Jul 2013 15:20:31 +0000 andrew carbn 360247@https://legacy.forums.gravityhelp.com/ <p>For anybody who is interested, here is the final code which is tested and working:</p> <p>ORIGINAL EXAMPLE CODE:<br /> *************************************************************************************<br /> add_action("gform_after_submission_1", "push_fields", 10, 2);<br /> function push_fields($entry, $form){</p> <p>$uploaderName = $entry["1"];<br /> $venueName = $entry["2"];<br /> $uploaderEmail = $entry["3"];</p> <p>$con=mysqli_connect("$DB_HOST","$DB_USER","$DB_PASSWORD","$DB_NAME");<br /> mysqli_query($con,"INSERT INTO $TABLE_NAME<br /> (uploaderName, venueName, uploaderEmail)<br /> VALUES<br /> ('$uploaderName', '$venueName', '$uploaderEmail')");<br /> }<br /> *************************************************************************************</p> <p>NEW CODE USING mysqli_real_escape_string via $wpdb:<br /> !!!!! Note re-ordering of SQL login details in line 9 below !!!!!!<br /> !!!!! DO NOT add or remove any double or single quotes !!!!!!<br /> *************************************************************************************<br /> add_action("gform_after_submission_1", "push_fields", 10, 2);<br /> function push_fields($entry, $form){</p> <p>$uploaderName = $entry["1"];<br /> $venueName = $entry["2"];<br /> $uploaderEmail = $entry["3"];</p> <p>global $wpdb;<br /> $con = new wpdb ("$DB_USER", "$DB_PASSWORD", "$DB_NAME", "$DB_HOST");<br /> $con-&gt;show_errors();<br /> $con-&gt;INSERT('$TABLE_NAME',<br /> array(<br /> 'uploaderName'=&gt;$uploaderName,<br /> 'venueName'=&gt;$venueName,<br /> 'uploaderEmail'=&gt;$uploaderEmail,<br /> ),<br /> array(<br /> '%s','%s','%s'<br /> )<br /> );<br /> }<br /> ************************************************************************************* </p> https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database#post-344251 Tue, 25 Jun 2013 12:15:45 +0000 Alex Cancado 344251@https://legacy.forums.gravityhelp.com/ <p>It is because that method will do the escaping for you. As long as you are using the methods from $wpdb, you don't have to worry about escaping. That is the beauty of it. </p> https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database#post-344190 Tue, 25 Jun 2013 11:22:52 +0000 andrew carbn 344190@https://legacy.forums.gravityhelp.com/ <p>Thanks.<br /> I've had a look at that page and something is not making sense to me.<br /> Under the section "INSERT rows" is says "Both $data columns and $data values should be "raw" (neither should be SQL escaped)."<br /> Is this because I am "inserting" data, and the danger is only when I am "querying" the data? </p> https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database#post-337229 Fri, 21 Jun 2013 18:14:56 +0000 Alex Cancado 337229@https://legacy.forums.gravityhelp.com/ <p>Hello Andrew,<br /> What you want to do is look at using the global $wpdb variable instead. It will handle escaping for you. Following is the doc page for it.<br /> <a href="http://codex.wordpress.org/Class_Reference/wpdb" rel="nofollow">http://codex.wordpress.org/Class_Reference/wpdb</a> </p> https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database#post-336848 Fri, 21 Jun 2013 13:10:52 +0000 andrew carbn 336848@https://legacy.forums.gravityhelp.com/ <p>Excellent. Thanks. </p> https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database#post-334777 Thu, 20 Jun 2013 15:33:32 +0000 David Peralty 334777@https://legacy.forums.gravityhelp.com/ <p>I'm going to send this thread to our developers to look at. </p> https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database#post-334577 Thu, 20 Jun 2013 12:56:57 +0000 andrew carbn 334577@https://legacy.forums.gravityhelp.com/ <p>Hello, I'm still waiting for a reply. </p> https://legacy.forums.gravityhelp.com/topic/using-mysqli_real_escape_string-with-gform_after_submission-and-a-mysql-database#post-323487 Fri, 14 Jun 2013 14:51:48 +0000 andrew carbn 323487@https://legacy.forums.gravityhelp.com/ <p>Hi,<br /> I think I'm correct in saying it is best practice to use mysqli_real_escape_string when pushing any user-generated text into a mySQL database.<br /> I'm using the below code (which is tested and working) to push the submitted data from a gravity form into mySQL.</p> <p>&lt;?php<br /> add_action("gform_after_submission_9", "push_fields", 10, 2);<br /> function push_fields($entry, $form){</p> <p>$uploaderName = $entry["1"];<br /> $organiserName = $entry["2"];<br /> $organiserEmail = $entry["3"];<br /> $organiserNumber = $entry["4"];<br /> $venueNumber = $entry["5"];</p> <p>$con=mysqli_connect("hostname","username","password","dbname");<br /> mysqli_query($con,"INSERT INTO table (uploaderName, organiserName,<br /> organiserEmail, organiserNumber, venueNumber) VALUES ('$uploaderName',<br /> '$organiserName', '$organiserEmail', '$organiserNumber', '$venueNumber')");<br /> }<br /> ?&gt;</p> <p>So how do I use real_escape_string?</p> <p>I tried these two ideas but neither worked:<br /> $uploaderName = mysqli_real_escape_string($entry["1"]);<br /> and<br /> $uploaderNameX = $entry["1"];<br /> $uploaderName = mysqli_real_escape_string($uploaderNameX);</p> <p>And by "neither worked" I mean the first one crashed my entire site, and the second one just left that column blank in the mySQL table but entered all other info correctly. </p>