What is the issue with saving a string containing a single quote in a MySQL query in PHP?

When saving a string containing a single quote in a MySQL query in PHP, it can cause syntax errors or SQL injection vulnerabilities. To solve this issue, you can use prepared statements or escape the single quote in the string before including it in the query. 

// Using prepared statements to save a string containing a single quote in a MySQL query
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Prepare a SQL statement
$stmt = $conn->prepare("INSERT INTO table_name (column_name) VALUES (?)");
$stmt->bind_param("s", $string_with_single_quote);

// Set parameter values and execute the statement
$string_with_single_quote = "O'Connor";
$stmt->execute();

// Close the statement and connection
$stmt->close();
$conn->close();

Keywords

PHP MySQL string single quote escaping

Related Questions