Question

I’m using PDO and was under the impression that prepare escaped apostrophes but I can see that isn’t the case. what do I use to escape my strings for apostrophes?

---

$sql = 'SELECT test FROM test WHERE id = :id';
$sth = $dbh->prepare($sql);
$sth->execute(array(':id' => 1));
$red = $sth->fetchAll();

Answer 1

I suspect that whilst you might be using a prepared statement, you are not binding parameters. For example, instead of

$val = "Some string with an a'postrophe in it";
$stmt = $pdo->prepare("UPDATE table SET col = '$val'");
$stmt->execute();

You should use

$val = "Some string with an a'postrophe in it";
$stmt = $pdo->prepare('UPDATE table SET col = :val');
$stmt->bindParam('val', $val);
$stmt->execute();

or at least

$val = "Some string with an a'postrophe in it";
$stmt = $pdo->prepare('UPDATE table SET col = :val');
$stmt->execute(array('val' => $val));

This is using named parameters but you can also use positional ones using ? as a placeholder