mysql_escape_string VS mysql_real_escape_string
PhpEscapingMysql Real-Escape-StringPhp Problem Overview
I know that mysql_escape_string is deprecated from 5.3 but what was the actual difference in mysql_real_escape_string.
What I thought was that mysql_real_escape_string is the exact same as mysql_escape_string apart from mysql_real_escape_string takes a second argument for the mysql resource.
So then I thought well surely there must be some difference as to how strings are handled because there would not be a need for 2 functions.
So then I thought that the difference was purely down to locale and character encodings?
Php Solutions
Solution 1 - Php
The difference is that mysql_escape_string just treats the string as raw bytes, and adds escaping where it believes it's appropriate.
mysql_real_escape_string, on the other hand, uses the information about the character set used for the MySQL connection. This means the string is escaped while treating multi-byte characters properly; i.e., it won't insert escaping characters in the middle of a character. This is why you need a connection for mysql_real_escape_string; it's necessary in order to know how the string should be treated.
However, instead of escaping, it's a better idea to use parameterized queries from the MySQLi library; there has previously been bugs in the escaping routine, and it's possible that some could appear again. Parameterizing the query is much, much harder to mess up, so it's less likely that you can get compromised by a MySQL bug.
Solution 2 - Php
Well... sort of, yes. It takes the character set of the MySQL connection into account.
http://php.net/mysql_escape_string
> This function is identical to mysql_real_escape_string() except that mysql_real_escape_string() takes a connection handler and escapes the string according to the current character set. mysql_escape_string() does not take a connection argument and does not respect the current charset setting.
Solution 3 - Php
mysql_escape_string is not deprecated from 5.3 but, for 4.3.0 and above.
So any One using PHP version above/or 4.3.0 should use mysql_real_escape_string.
if using php < 4.3.0, than make your magic_quotes_gpc active from php.ini, though it is recommended to update, but if your code will have problem than make sure you use, magic_quotes_gpc and addslash function rather than mysql_escape_string.
Solution 4 - Php
now both of these functions are deprecated in
> PHP 4 >= 4.3.0 and PHP 5.
They recommend using PDO_MySQL extension