Issue with mysql_real_escape_string

Question

I have the following query:
SELECT * FROM ships WHERE shipCode="SP"
SELECT * FROM ships WHERE shipCode=\"SP\"

The first works fine, the second which is the result of calling mysql_real_escape_string on the first string, doesn't work and gives the useless error message #1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\"SP\"' at line 1

What's wrong with it?

shipCode is a VARCHAR(2)

Post your PHP code. MySQL may accept single quoted strings, depending how it is configured, but single quotes are standard SQL. — Michael Berkowski
– Michael Berkowski, Commented Mar 6, 2012 at 2:00
You shouldn't be using mysql_* functions anymore. Use the mysqli or Pdo class instead. — Levi Morrison
– Levi Morrison, Commented Mar 6, 2012 at 2:09

deceze · Accepted Answer · 2012-03-06 02:02:59Z

4

You're not supposed to call mysql_real_escape_string on the whole string. You use it only on the values you're concatenating into your query.

Wrong:

$query = 'SELECT * FROM ships WHERE shipCode="' . $var . '"';
$query = mysql_real_escape_string($query);

Right:

$query = 'SELECT * FROM ships WHERE shipCode="' . mysql_real_escape_string($var) . '"';

Even better: Prepared statements.

answered Mar 6, 2012 at 2:02

deceze♦

525k89 gold badges806 silver badges954 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Toto · Accepted Answer · 2012-03-06 12:58:00Z

0

you need to have valid connection with mysql set up before you use mysql_real_escape string . do it like this

$attr="sp";
Select * from ships where shipcode = '" . mysql_real_escape_string($attr) . "';

edited Mar 6, 2012 at 12:58

Toto

91.7k63 gold badges97 silver badges135 bronze badges

answered Mar 6, 2012 at 2:13

sapan aryal

135 bronze badges

Collectives™ on Stack Overflow

Issue with mysql_real_escape_string

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related