mysqli_real_escape_string

Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection (PHP 5)
string mysqli_real_escape_string ( mysqli link, string escapestr )

Example 1541. Object oriented style

<?php

$mysqli = new mysqli("localhost", "my_user", "my_password", "world");

/* check connection */
if (mysqli_connect_errno()) {

    printf("Connect failed: %s\n", mysqli_connect_error());

    exit();

}

$mysqli->query("CREATE TEMPORARY TABLE myCity LIKE City");

$city = "'s Hertogenbosch";

/* this query will fail, cause we didn't escape $city */
if (!$mysqli->query("INSERT into myCity (Name) VALUES ('$city')")) {

    printf("Error: %s\n", $mysqli->sqlstate);

}

$city = $mysqli->real_escape_string($city);

/* this query with escaped $city will work */
if ($mysqli->query("INSERT into myCity (Name) VALUES ('$city')")) {

    printf("%d Row inserted.\n", $mysqli->affected_rows);

}

$mysqli->close();
?>

Example 1542. Procedural style

copy to clipboard

<?php

$link = mysqli_connect("localhost", "my_user", "my_password", "world");

/* check connection */
if (mysqli_connect_errno()) {

    printf("Connect failed: %s\n", mysqli_connect_error());

    exit();

}

mysqli_query($link, "CREATE TEMPORARY TABLE myCity LIKE City");

$city = "'s Hertogenbosch";

/* this query will fail, cause we didn't escape $city */
if (!mysqli_query($link, "INSERT into myCity (Name) VALUES ('$city')")) {

    printf("Error: %s\n", mysqli_sqlstate($link));

}

$city = mysqli_real_escape_string($link, $city);

/* this query with escaped $city will work */
if (mysqli_query($link, "INSERT into myCity (Name) VALUES ('$city')")) {

    printf("%d Row inserted.\n", mysqli_affected_rows($link));

}

mysqli_close($link);
?>

Code Examples / Notes » mysqli_real_escape_string

Note that this function will NOT escape _ (underscore) and % (percent) signs, which have special meanings in LIKE clauses. As far as I know there is no function to do this, so you have to escape them yourself by adding a backslash in front of them.

mysqli_real_escape_string

Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection (PHP 5) string mysqli_real_escape_string ( mysqli link, string escapestr )

Example 1541. Object oriented style

Example 1542. Procedural style

Code Examples / Notes » mysqli_real_escape_string

Change Language

Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection (PHP 5)
string mysqli_real_escape_string ( mysqli link, string escapestr )