Can someone please explain MySQL_real_escape_string

[MjM8082]

What exactly does mysql_real_escape_string do?

 

And please give examples not just what it is. Thanks

[MMDE]

http://php.net/manual/en/function.mysql-real-escape-string.php

"Use of this extension is discouraged. Instead, the MySQLi or PDO_MySQL extension should be used. See also MySQL: choosing an API guide and related FAQ for more information. Alternatives to this function include:

mysqli_real_escape_string()

PDO::quote()"

 

I guess you are following my advice and are attempting to sanitize the users' input, but I wouldn't recommend using mysql_real_escape_string to do so.

[peipst9lker]

The function escapes characters like ' and " to prevent MySQL Injections which is a sort of attack to gain access to your database without permission.

 

$query = "SELECT * FROM table WHERE name = '".mysql_real_escape_string($userinput)."'";