What is the purpose of using mysql_escape_string() in PHP when dealing with SQL queries?

When dealing with SQL queries in PHP, the purpose of using mysql_escape_string() is to escape special characters in a string to prevent SQL injection attacks. SQL injection attacks occur when a user input is not properly sanitized, allowing malicious SQL code to be executed. By using mysql_escape_string(), special characters such as quotes are properly escaped, making the input safe to use in SQL queries. 

// Example of using mysql_escape_string() to prevent SQL injection
$input = "John's Book";
$escaped_input = mysql_escape_string($input);

$query = "SELECT * FROM books WHERE title = '$escaped_input'";
$result = mysql_query($query);

Keywords

PHP mysql_escape_string() SQL queries data sanitization security

Related Questions