Question

I just disabled magic_quotes_gpc and I notice that the user input into my database has apostrophes as if nothing was escaped.

($_POST['message'])="it's a test";
$string = mysql_real_escape_string(htmlentities($_POST['message']));

Then I insert it into the database and the database shows:
it's a test

Isn’t it supposed to be it\'s a test, after I applied mysql_real_escape_string?
Or is it the database (here, with PHPMyAdmin) that translates those \' into '?
Thanks in advance.

Answer 1

The purpose of escaping SQL is to avoid SQL innjection. INSERT INTO table VALUES ('it's a test') .. would cause you trouble, but when you escape it it turns to INSERT INTO table VALUES ('it\'s a test') .. and that will work and insert “‘it’s a test'” to your database.