What is the significance of the '\' character being added to SQL commands when entering a single quote?

When entering a single quote in an SQL command, it can cause syntax errors or be interpreted as the end of the string, leading to potential SQL injection vulnerabilities. To prevent this, the '\' character can be added before the single quote to escape it and ensure it is treated as a regular character within the SQL command. 

$user_input = "John's";
$escaped_input = str_replace("'", "\'", $user_input);
$sql = "INSERT INTO users (name) VALUES ('$escaped_input')";

Keywords

PHP SQL injection escape character security vulnerability single quote

Related Questions