Escape string in mssql/php

Question

I want to insert html-code in database. How can I correctly escape string?

$html = '<tag>';
$sql = 'UPDATE table SET text = ? WHERE id = 1';
$stmt = sqlsrv_prepare($conn, $sql, array(&$html));
sqlsrv_execute($stmt);

This code throw error: Incorrect syntax near '<'.

Answer 1

Escape the HTML with

htmlspecialchars($html)

This function changes < to the HTML code for <

This will fix you problem.