Skip to main content
added 1 characters in body; added 2 characters in body; added 3 characters in body
Source Link
Wh1T3h4Ck5
  • 8.5k
  • 10
  • 63
  • 82

manual mysql_real_escape_string()

Escapes special characters in a string for use in an SQL statement

So you can't escape entire query, just data... because it will escape all unsafe characters like quotes (valid parts of query).

If you try something like that (to escape entire query)

echo mysql_real_escape_string("INSERT INTO some_table VALUES ('xyz', 'abc', '123');");

Output is

INSERT INTO some_table VALUES(\'xyz\', \'abc\', \'123\');

INSERT INTO some_table VALUES ('xyz', 'abc', '123');

and that is not valid query any more.

manual mysql_real_escape_string()

Escapes special characters in a string for use in an SQL statement

So you can't escape entire query, just data because it will escape all unsafe characters like quotes (valid parts of query).

If you try something like that (to escape entire query)

echo mysql_real_escape_string("INSERT INTO some_table VALUES('xyz', 'abc', '123');");

Output is

INSERT INTO some_table VALUES(\'xyz\', \'abc\', \'123\');

and that is not valid query any more.

manual mysql_real_escape_string()

Escapes special characters in a string for use in an SQL statement

So you can't escape entire query, just data... because it will escape all unsafe characters like quotes (valid parts of query).

If you try something like that (to escape entire query)

echo mysql_real_escape_string("INSERT INTO some_table VALUES ('xyz', 'abc', '123');");

Output is

INSERT INTO some_table VALUES ('xyz', 'abc', '123');

and that is not valid query any more.

Source Link
Wh1T3h4Ck5
  • 8.5k
  • 10
  • 63
  • 82

manual mysql_real_escape_string()

Escapes special characters in a string for use in an SQL statement

So you can't escape entire query, just data because it will escape all unsafe characters like quotes (valid parts of query).

If you try something like that (to escape entire query)

echo mysql_real_escape_string("INSERT INTO some_table VALUES('xyz', 'abc', '123');");

Output is

INSERT INTO some_table VALUES(\'xyz\', \'abc\', \'123\');

and that is not valid query any more.