Question

I have a lot of text to insert into a MySQL table using PHP. Part of the text looks like this example:

Yes, this is 'great'!

To fill this into an SQL Statement, I need to escape the '.

I’m using an ereg-replace $text=mb_ereg_replace("'","\\'", $text); to make the following work:

$sql="insert into mytable (msg) values ('".$text."')";

Now I found out that there is also another text-style, where I have to save to MySQL something like this:

As you can see the \' world\' is a "disc"!

So I tried adding more mb_ereg_replace like this:

$text=mb_ereg_replace("'","\\'", $text);
$text=mb_ereg_replace("\\","\\\\", $text);

But this does not work, I just get the error message: PHP Warning: mb_ereg_replace(): mbregex compile err: end pattern at escape in [...]

What causes this? I probably made some mistake, but can’t find it!

Thank you for any kind of help.

Answer 1

Use mysql_real_escape_string to escape your strings.

$text = mysql_real_escape_string($text);

Or better, use PDO and parameterized queries.