php - database doesn't allow special chars even after using mysqli_real_escape_string -

i have found lots of question @ so , followed solution,but didn't work in case.

i want insert + database,so have used

$tex5=mysqli_real_escape_string($connect_dude,$_post['text5']); 

but doesn't insert +.it gives empty space(whitespace) in database.

please informed,i'm using prepared statement , parameterized query.is reason why database doesn't allow +?if yes,then how can fix this?

thanks time.

code

javascript

//call con_edi() on first button clicked.insert email on text field , click button fire off change5()      function con_edi(){    document.getelementbyid("alu").innerhtml="<input type='text'  id='taxi' style='border:1px solid black;'><input type='submit' id='' onclick='change5(taxi.value)' value='change'>";  }  function change5(s){    var form=s;    if(!form.match(/^[a-za-z0-9_.+-]+@[a-za-z0-9-]+\.[a-za-z0-9-.]+$/)){       alert("wrong email");    }else{      //document.write(form);  /*for testing output*/      var ajax=new xmlhttprequest();      ajax.open("post","contact.php",true);      ajax.setrequestheader("content-type","application/x-www-form-urlencoded");      ajax.onreadystatechange=function(){        if(ajax.readystate == 4 && ajax.status == 200){            location.reload();          }       }      ajax.send("text5="+form);    }  } 

php

$tex5=mysqli_real_escape_string($connect_dude,$_post['text5']); $query6="update `$database`.`header` set email=?  user_id=?";  mysqli_stmt_prepare($stmt1, $query6); mysqli_stmt_bind_param($stmt1, "si", $tex5, $logged_id); mysqli_stmt_execute($stmt1); 

you need url-encode value sending.

right now, sending text5=lkf+alu@craftwebart.com – , in url context, + “replacement” character space character. why script inserting space char database, not because there wrong insertion database per se. (although, mentioned, using mysqli_real_escape_string in combination prepared statements is wrong. mysqli_real_escape_string used mask special characters inserted sql syntax directly, can not confused actual sql syntax. when using prepared statements placeholders however, sql command , data send database separate each other, danger not exist in context.)

so, need use

ajax.send("text5="+encodeuricomponent(form)); 

to send data server. encodeuricomponent takes care of encoding data url context. make + character %2b, can send in context safely, , php decode + automatically.