Click here to Skip to main content
15,923,845 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi Friends

I am working on a PHP, MySql web application. But I am confronting a critical error using mysql_real_escape_string function
For Example:
My SQL Query is
$query = "Select * from tbl_name where field_name = 'Pirates'";

after passing it from mysql_real_escape_string() function this query becomes
$query = "Select * from tbl_name where field_name = \'Pirates\'";

So now although 'Pirates' exists in my database but now it has become \'Pirates\'. Therefore when I run this query it gives me no record.
Note: If i search any field whose data type is numeric, this query gives me the correct result. (Because no quote is used for a numeric data)

Can some one has the solution for this problem?
Posted

1 solution

This function is meant to encode components that go into an SQL query and is not to be applied to the whole SQL statement! Please RTFM here: http://php.net/manual/en/function.mysql-real-escape-string.php[^].

It shows an example on how to use it correctly.

Happy coding!
 
Share this answer
 
v4
Comments
rashidfarooq 3-Apr-11 12:18pm    
Thanks a lot for helping me. I have understood it completely.
Manfred Rudolf Bihy 3-Apr-11 12:37pm    
Great! I'm glad I could help.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900