Question

I’m escaping a string using the OOP method of mysqli_real_escape_string. I saved the input being entered into a session variable to make sure it’s escaping correctly. It seems to be escaping correctly, but when I check what gets entered into the database I don’t see the slashes before single and double quotes.

So in the browser I echo:

Array
(
    [formContent] => I\'m always here!
)

But in the database I see:

I'm always here!

Does this mean there’s something wrong with my code somewhere?

Answer 1

No, it’s normal. mysqli_real_escape_string automatically escape the single quote for you.

When you have the string,

I'm always here!

mysqli_real_escape_string processed it as

I\'m always here!

so it will be saved on the database. That’s how it works.