How mysql_real_escape_string works

Question

How does mysql_real_escape_string work? Does mysql function delete or add // between mysql function? It is better than addlashes.

Answer 1

mysql_real_escape_string () calls the MySQL library function mysql_real_escape_string, which adds a backslash to the following characters: \ x00, \ n, \ r, \, ', "and \ x1a.

This function should always (with a few exceptions) be used to ensure data security before sending a query to MySQL.

IMO, it's better to use this feature than trying to recreate most of the time.

Answer 2

When disinfecting database entries, you should always use mysql_real_escape_string over addslashes and other non-native PHP functions if you are not using the new PDO library.

mysql_real_escape_string () calls the MySQL library function mysql_real_escape_string, which adds a backslash to the following characters: \ x00, \ n, \ r, \, ', "and \ x1a.

Source @ http://php.net/manual/en/function.mysql-real-escape-string.php

You should also know that PHP has provided its own library called PDO , which is the class that manages your database sanitation, so you don’t have to worry much.

Prepared statements are processed by the database service itself, which improves security and performance compared to all.

If you want to implement prepared statements, you will need to study and enable PDO. Another level of abstraction of your own database.

To implement PDO Click here

Read more about prepared reports. Click here.