When you look in the table, it should be O'Connor - that means the string was escaped properly in the SQL. If it hadn't been escaped by mysql_real_escape_string, you probably would have ended up with a syntax error.

The query would end up as:

INSERT INTO user(password) VALUES ('O'Connor)

If you want the backslashes in the DB, try using addslashes before you pass it to mysql_real_escape_string, but you probably don't.

When you look in the table, it should be O'Connor - that means the string was escaped properly in the SQL. If it hadn't been escaped by mysql_real_escape_string, you probably would have ended up with a syntax error.

The query would end up as:

INSERT INTO user(password) VALUES ('O'Connor)

If you want the backslashes in the DB, try using addslashes before you pass it to mysql_real_escape_string, but you probably don't.