Question

I am having following php string: “Device/ mo\bile’s”;
I want to insert it into db and so before insert i am sanitizing it with addslashes function
and sanitization happens but the string is inserted into the db as “Device/ mobile’s” ie. backlash vanishes.

I want to retain ‘\’ also.
Anybody suggest how can i do that.
Thanks in advance.

Answer 1

Don’t use addslashes for escaping SQL. In fact, don’t use addslashes for anything. If you are still using the by now deprecated mysql_* functions, use mysql_real_escape_string. If you’re using the newer mysqli_* or PDO extension, use prepared statements. Then all data will be inserted properly. If you use unrelated escaping functions which do not consider to appropriate escaping rules for the language at hand, you won’t get the correct results.