What is the difference between mysql_escape_string and mysql_real_escape_string in PHP?

The main difference between mysql_escape_string and mysql_real_escape_string in PHP is that mysql_escape_string is deprecated and should not be used, as it does not provide adequate protection against SQL injection attacks. On the other hand, mysql_real_escape_string is a safer option as it escapes special characters in a string for use in an SQL statement, helping to prevent SQL injection vulnerabilities. 

// Using mysql_real_escape_string to escape special characters in a string before using it in an SQL statement
$unsafe_string = "John's car";
$safe_string = mysql_real_escape_string($unsafe_string);
$query = "INSERT INTO users (name) VALUES ('$safe_string')";
$result = mysql_query($query);

Keywords

PHP mysql_escape_string mysql_real_escape_string SQL injection security

Related Questions