Question

$brand_condition = ' AND ' . mysql_real_escape_string($brand_selection) . ' IN ';

$brand_condition .= $quote10 . '"'. mysql_real_escape_string($brand_value) . '"' .$quote9;

$brand_conditions[] = $brand_condition;

$query .= implode(' AND ', $brand_conditions) . '';

This produces: AND manufacturer IN (“brand1,brand2”)

Since I’m using the IN statement, I need the values to be quoted. At the same time, I am escaping potential quotes with mysql_real_escape_string.

Does anyone see a simple way to get around this small problem?

Answer 1

function quote_escape(&$str) {
    $str = '"' . mysql_real_escape_string(chop($str)) . '"';
}

$brands = explode(',', $brand_value);
array_walk($brands, "quote_escape");
$brands = implode(',', $brands);

or

function quote_escape($str) {
     return '"' . mysql_real_escape_string(chop($str)) . '"';
}
$brands = implode(',', array_map("quote_escape", explode(',', $brand_value)));