MySQL and PHP
Copyright 1997-2021 the PHP Documentation Group.
mysql_escape_string
Escapes a string for use in a mysql_query
This function was deprecated in PHP 4.3.0, and it and the entire original MySQL extension was removed in PHP 7.0.0. Instead, use either the actively developed MySQLi or PDO_MySQL extensions. See also the MySQL: choosing an API guide and its related FAQ entry for additional information. Alternatives to this function include:
mysqli_escape_string
|
PDO::quote
|
string mysql_escape_string(string unescaped_string);
This function will escape the
unescaped_string
, so that it is safe to
place it in a
mysql_query
.
This function is deprecated.
This function is identical to
mysql_real_escape_string
except that
mysql_real_escape_string
takes a connection handler and escapes the string according to
the current character set.
mysql_escape_string
does not take a connection argument and does not respect the
current charset setting.
unescaped_string
The string that is to be escaped.
Returns the escaped string.
Example 6.16 mysql_escape_string
example
<?php $item = "Zak's Laptop"; $escaped_item = mysql_escape_string($item); printf("Escaped string: %s\n", $escaped_item); ?>
The above example will output:
Escaped string: Zak\'s Laptop
mysql_escape_string
does not escape %
and _
.
mysql_real_escape_string
|
addslashes
|
The magic_quotes_gpc directive. |