Question

I am trying to run this query but can’t figure out why MySQL doesnt like the first value to have its quotes escaped.
I am escaping my string:

$query = mysql_real_escape_string("INSERT INTO `Promotion` (`TransactionID`) VALUES ('$transaction_id');");

So now $query is:

INSERT INTO `Promotion` (`TransactionID`) VALUES (\'20111025201459\');

This however will not work. I get a syntax error on the first escaping slash in the values list.

Thanks

Answer 1

The point of escaping is to prevent the data from interfering with the SQL syntax. Therefore, you should not escape the entire query; only the actual data.

The right line would therefore be:

$query = "INSERT INTO `Promotion` (`TransactionID`) VALUES ('".mysql_real_escape_string($transaction_id)."');";

If you prefer, that can be split over two lines:

$escaped_transaction_id=mysql_real_escape_string($transaction_id);
$query = INSERT INTO `Promotion` (`TransactionID`) VALUES ('$escaped_transaction_id');";