How to insert a string containing quotation marks into a database?

Question

When I try to execute a line containing a quotation mark, the INSERT request fails. How to insert strings with single or double quotes?

eg:

$message = "Bob said 'don't forget to call me'";

mysql_query("INSERT INTO someTable (messages) VALUES ('$message')");

I suppose the input should be filtered out, but what function should I use for this?

Answer 1

$message = mysql_real_escape_string($message);

this function should be applied to each variable that you intend to insert into the query in quotation marks. No exceptions.
This is not injection protection, but simply a syntax rule.

. : PHP htmlspecialchars() ?

Answer 2

: mysql_real_escape_string

, , , , SQL .

Answer 3

, , - , ? SQL-