Question

I don’t understand why mysql_real_escape_string needs to escape new line and carriage return chars:

\n and \r

What could be the security holes in a sql with \n and \r ?

UPDATE tbl SET field = 'text text text \n text text text \r text text' WHERE id = 1;

Answer 1

MySQL doesn’t require the newline character to be escaped. The manual page for the mysql_real_escape_string function of MySQL’s C API says:

Characters encoded are “\”, “'”, “"”, NUL (ASCII 0), “\n”, “\r”, and Control+Z. Strictly speaking, MySQL requires only that backslash and the quote character used to quote the string in the query be escaped. mysql_real_escape_string() quotes the other characters to make them easier to read in log files.