Question

I have the following data as an example:

$a = addslashes('hello\'s');
$b = serialize($a);

// As you know, $b looks like this s:8:"hello\'s";

Now when I insert $b to MySQL, the data now looks like this s:8:”hello’s” inside MySQL.
MySQL removes the \ and now I have an invalid serialized data.

What’s the best way to fix this? Thanks

Answer 1

First serialize the value you want and then use the mysql_real_escape_string. That’s the string you are going to put in the database after all. Try to avoid addslashes…

If you don’t want to have an active connection at the time, try this function:

function mysql_escape_no_conn( $input ) { 

    if( is_array( $input ) ) {
        return array_map( __METHOD__, $input ); 
    }
    if( !empty( $input ) && is_string( $input ) ) { 
        return str_replace( array( '\\', "\0", "\n", "\r", "'", '"', "\x1a" ), 
                            array( '\\\\', '\\0', '\\n', '\\r', "\\'", '\\"', '\\Z' ),
                            $input ); 
} 

return $input; 

}