Question

I use mysql_real_escape_string on stuff that gets put in my database, so something like Bob's Shop would turn into Bob\'s Shop. And, for example, if I try to select all the entries that contain Bob\'s, my select statement looks like:

SELECT * FROM tbl WHERE name LIKE '%Bob\\\'s%' 

and for whatever reason, it doesn’t work, even though it makes complete sense that it would work.

Answer 1

I fixed it (thanks to Michael for showing me how). I’m posting what I did in case someone else has this problem.

Never figured out how to properly put escape characters in a LIKE, but the problem was that I had magic quotes turned on, so whenever I used mysql_real_escape_string, it added additional escape characters so that instead of being stored as Bob’s, it was stored as Bob\’s. This is the documentation to disable magic quotes: http://www.php.net/manual/en/security.magicquotes.disabling.php
For me, putting php_flag magic_quotes_gpc Off or php_value magic_quotes_gpc Off in the .htaccess didn’t work because I’m using purchased hosting and the host doesn’t allow settings like that or something. So instead I put magic_quotes_gpc = Off in a file called php.ini and put it in every directory that I needed it.

Since I already had a lot of rows in my MySQL database that contained the extra backslashes, I needed to get rid of them when I turned off magic quotes. You can do this easily by issuing a query like this: UPDATE tbl SET col=REPLACE(col,'\\\'','\'') WHERE col LIKE '%\'%' Replace tbl with your table name and col with any column you’re working with. If there’s other escape characters you need to fix, just change the REPLACE and LIKE to reflect that. There’s probably better code to do all columns and all escape characters in one swoop, but for my purposes I didn’t need that.