Question

How do I escape data being inserted into a MySQL table without using an SQL escape string to protect against SQL injection?

I’m using Yii framework which uses PDO and does not support multiple queries. I need to run multiple insert queries and need to escape the values being inserted.

Yii::app()->quoteValue does not work because it places quotes "" around the input being inserted into mysql. Is there a PHP function I can use to protect against SQL injections?

Answer 1

You can add slashes with

$string = addslashes($string);

However, it’s recommended you try and use the proper mysql methods instead so I wouldn’t count on this being a perfect replacement.