TalkPHP - View Single Post

Alex · 07-21-2008, 04:07 PM

Backticks are ` (Press the button to the left of 1). You should use them for escaping table & column names.
i.e.

Code:

INSERT INTO `atable`(`name`,`content`)....

You should use apostrophes for escaping values. i.e.

Code:

INSERT INTO `atable`(`name`,`content`) VALUES('The title value', 'The content')

If one or more of your values are strings, then you should probably escape them before using them in a query. Escaping them involves adding backslashes to characters which mysql could interpret as a command / operator.

Code:

INSERT INTO `atable`(`name`,`content`) VALUES('The title value', 'I'm the king of England')

That query will fail because of the apostrophe in I'm the kind of England. Mysql treats it as the end of the string, and then gets very confused when it sees

Code:

m the kind of England')

as it doesn't know how to interpret it.

To escape a string, use the mysql_real_escape function. It will automatically go through the string and escape (place a backslash in front of) any characters which could confuse MYSQL. The backslash will tell mysql to ignore the following character.

The backslashes which are used to escape characters such as ' will not be stored in the table.

07-21-2008, 04:07 PM	#5 (permalink)
Alex The Wanderer Join Date: May 2008 Posts: 17 Thanks: 2	Backticks are ` (Press the button to the left of 1). You should use them for escaping table & column names. i.e. Code: INSERT INTO `atable`(`name`,`content`).... You should use apostrophes for escaping values. i.e. Code: INSERT INTO `atable`(`name`,`content`) VALUES('The title value', 'The content') If one or more of your values are strings, then you should probably escape them before using them in a query. Escaping them involves adding backslashes to characters which mysql could interpret as a command / operator. Code: INSERT INTO `atable`(`name`,`content`) VALUES('The title value', 'I'm the king of England') That query will fail because of the apostrophe in I'm the kind of England. Mysql treats it as the end of the string, and then gets very confused when it sees Code: m the kind of England') as it doesn't know how to interpret it. To escape a string, use the mysql_real_escape function. It will automatically go through the string and escape (place a backslash in front of) any characters which could confuse MYSQL. The backslash will tell mysql to ignore the following character. The backslashes which are used to escape characters such as ' will not be stored in the table.