Cant inserts row into database due to single quote

Question

I am trying to insert this json content into my database.

But I get a null result in the Summary, because the text is like this:

summary":"One of the oldest cities in the United States, Boston definitely has an \"old city\" feel to it. Home to great architecture and historical buildings, the city is also a great place to visit with younger ones, as it also plays host to LEGOLAND and many more children attractions."

I think this is due to one quote and my PHP request '{$summary}'.

$url = file_get_contents("urlcontent/api.json");
$arr = json_decode($url, true);

for($i=0;$i < count($arr);$i++){

$id         = $arr[$i]['id'];  
$location   = $arr[$i]['location'];
$summary    = $arr[$i]['summary'];   

$query = "INSERT INTO [databasename].[dbo].[table]( id , summary, location)";
$query .= "VALUES ('{$id}', '{$summary}', '{$location}' )";

$update_query = sqlsrv_query($con, $query);

  if(!$update_query){
      die("There was an error" .print_r( sqlsrv_errors($con), true));
                }
}

I tried to fix this with:

$summary = preg_replace("'", "", $arr[$i]['summary']);
$summary = str_replace("'", "", $arr[$i]['summary']);
REPLACE('{$summary}','''','''') //MSSQL Database command

But still can’t insert this text and get the result NULL. I can echoand var_dump, and the text is fine, I just can’t insert it into my table.

My resume is like textin my database.

How to make it work? Greetings

Answer 1

, .

$query = "INSERT INTO [databasename].[dbo].[table]( id , summary, location)";
$query .= "VALUES (?, ?, ?)";

$update_query = sqlsrv_prepare($con, $query, [$arr[$i]['id'], $arr[$i]['location'], $arr[$i]['summary']]);
if (!sqlsrv_execute($update_query)) {
  die("There was an error" .print_r( sqlsrv_errors($con), true));
}