PHP Basic
PHP HOME PHP Intro PHP Install PHP Syntax PHP Variables PHP String PHP Operators PHP If...Else PHP Switch PHP Arrays PHP Sorting Arrays PHP While Loops PHP For Loops PHP Functions PHP Forms PHP $_GET PHP $_POSTPHP Advanced
PHP Arrays Multi PHP Date PHP Include PHP File PHP File Upload PHP Cookies PHP Sessions PHP E-mail PHP Secure E-mail PHP Error PHP Exception PHP FilterPHP Database
PHP MySQL Intro PHP MySQL Connect PHP CREATE DB/Table PHP INSERT INTO PHP SELECT PHP WHERE PHP ORDER BY PHP UPDATE PHP DELETE PHP ODBCPHP XML
XML Expat Parser XML DOM XML SimpleXMLPHP and AJAX
AJAX Intro AJAX PHP AJAX Database AJAX XML AJAX Live Search AJAX RSS Reader AJAX PollPHP Reference
PHP Array PHP Calendar PHP Date PHP Directory PHP Error PHP Filesystem PHP Filter PHP FTP PHP HTTP PHP Libxml PHP Mail PHP Math PHP Misc PHP MySQLi PHP SimpleXML PHP String PHP XML PHP Zip PHP TimezonesPHP Quiz
PHP Quiz PHP CertificatePHP mysqli_real_escape_string() Function
Example
Escape special characters in a string:
<?php
$con=mysqli_connect("localhost","my_user","my_password","my_db");
// Check connection
if (mysqli_connect_errno($con))
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
mysqli_query($con,"CREATE TABLE myPersons LIKE Persons");
$newpers="Da'Silva"
// This query will fail, cause we did not escape $newpers
mysqli_query($con,"INSERT into myPersons (Lastname) VALUES ('$newpers')");
$newpers=mysqli_real_escape_string($con,$newpers);
// This query will work, cause we escaped $newpers
mysqli_query($con,"INSERT into myPersons (Lastname) VALUES ('$newpers')");
mysqli_close($con);
?>
$con=mysqli_connect("localhost","my_user","my_password","my_db");
// Check connection
if (mysqli_connect_errno($con))
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
mysqli_query($con,"CREATE TABLE myPersons LIKE Persons");
$newpers="Da'Silva"
// This query will fail, cause we did not escape $newpers
mysqli_query($con,"INSERT into myPersons (Lastname) VALUES ('$newpers')");
$newpers=mysqli_real_escape_string($con,$newpers);
// This query will work, cause we escaped $newpers
mysqli_query($con,"INSERT into myPersons (Lastname) VALUES ('$newpers')");
mysqli_close($con);
?>
Definition and Usage
The mysqli_real_escape_string() function escapes special characters in a string for use in an SQL statement.
Syntax
mysqli_real_escape_string(connection,escapestring);
| Parameter | Description |
|---|---|
| connection | Required. Specifies the MySQL connection to use |
| escapestring | Required. The string to be escaped. Characters encoded are NUL (ASCII 0), \n, \r, \, ', ", and Control-Z. |
Technical Details
| Return Value: | Returns the escaped string |
|---|---|
| PHP Version: | 5+ |
PHP MySQLi Reference
Your suggestion:
Close [X]
Thank You For Helping Us!
Your message has been sent to W3Schools.
Close [X]
