Escaping characters in PHP and retaining

Question

I have an app in PHP , I am getting first Name and last Name from several sources, (API's ,files etc) Suppose I get Name like john', john", How I can save the name as it is in the Database, the '," could be at any place,The problem is that when I write query like

Insert into table values('".$a."');

so If $a contains name John' then the query becomes Insert into table values('John''); which is wrong,( 2 ' at the end) How to cater these scenario in PHP?

possible duplicate of [How can I prevent SQL injection in PHP?](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — andrewsi, Oct 23 '13 at 14:41

score 0 · Accepted Answer · answered Oct 23 '13 at 14:42

0

$string=mysqli_real_escape_string($connection,$string);

This function is used to create a legal SQL string that you can use in an SQL statement. The given string is encoded to an escaped SQL string, taking into account the current character set of the connection.

Reference

answered Oct 23 '13 at 14:42

Hanky Panky

46,730
8
72
95

so should it retain the John' in the DB? – Oct 23 '13 at 14:49
Yes it will retain that – Hanky Panky Oct 23 '13 at 15:05
it converted it in to John/' – Oct 23 '13 at 15:53
No it is not, why don't you give it a try? it will be saved as John' – Hanky Panky Oct 24 '13 at 02:34

Escaping characters in PHP and retaining

1 Answers1