61

I know that mysql_escape_string is deprecated from 5.3 but what was the actual difference in mysql_real_escape_string.

What I thought was that mysql_real_escape_string is the exact same as mysql_escape_string apart from mysql_real_escape_string takes a second argument for the mysql resource.

So then I thought well surely there must be some difference as to how strings are handled because there would not be a need for 2 functions.

So then I thought that the difference was purely down to locale and character encodings?

Dharman
  • 30,962
  • 25
  • 85
  • 135
RobertPitt
  • 56,863
  • 21
  • 114
  • 161

4 Answers4

94

The difference is that mysql_escape_string just treats the string as raw bytes, and adds escaping where it believes it's appropriate.

mysql_real_escape_string, on the other hand, uses the information about the character set used for the MySQL connection. This means the string is escaped while treating multi-byte characters properly; i.e., it won't insert escaping characters in the middle of a character. This is why you need a connection for mysql_real_escape_string; it's necessary in order to know how the string should be treated.

However, instead of escaping, it's a better idea to use parameterized queries from the MySQLi library; there has previously been bugs in the escaping routine, and it's possible that some could appear again. Parameterizing the query is much, much harder to mess up, so it's less likely that you can get compromised by a MySQL bug.

Michael Madsen
  • 54,231
  • 8
  • 72
  • 83
  • i use PDO, this was just something that I needed to know for educational purposes . – RobertPitt Sep 08 '10 at 08:28
  • There's also a mysqli_escape_string(). Does also do the same thing as mysql_escape_string?? if mysql_escape_string is deprecated why there's this function available and in mysqli too??? – ltdev Mar 22 '13 at 07:54
  • 2
    @Lykos: [mysqli_escape_string is an alias for mysqli_real_escape_string](http://www.php.net/mysqli_escape_string), so the problem only applies to the old mysql_* functions. I would assume this was done as a convenience for people migrating from mysql to mysqli. – Michael Madsen Mar 22 '13 at 08:54
  • 1
    So either mysqli_escape_string() or mysqli_real_escape_string() both do the same thing, right? – ltdev Mar 22 '13 at 08:58
  • @Lykos: Correct, but as I write in the answer, you should really prefer parameterized queries over escaping. If you must, however, then you can use either - but I would probably prefer using mysqli_real_escape_string, just so you don't inadvertantly introduce a bug if you for some reason need to modify the script to run on a server that only has the old mysql module. – Michael Madsen Mar 22 '13 at 09:04
3

Well... sort of, yes. It takes the character set of the MySQL connection into account.

http://php.net/mysql_escape_string

This function is identical to mysql_real_escape_string() except that mysql_real_escape_string() takes a connection handler and escapes the string according to the current character set. mysql_escape_string() does not take a connection argument and does not respect the current charset setting.

deceze
  • 510,633
  • 85
  • 743
  • 889
3

mysql_escape_string is not deprecated from 5.3 but, for 4.3.0 and above. So any One using PHP version above/or 4.3.0 should use mysql_real_escape_string.

if using php < 4.3.0, than make your magic_quotes_gpc active from php.ini, though it is recommended to update, but if your code will have problem than make sure you use, magic_quotes_gpc and addslash function rather than mysql_escape_string.

al45tair
  • 4,405
  • 23
  • 30
Rocky Sharma
  • 39
  • 1
1

now both of these functions are deprecated in

PHP 4 >= 4.3.0 and PHP 5. They recommend using PDO_MySQL extension

Sourabh Kumar Sharma
  • 2,864
  • 3
  • 25
  • 33
Jeff_Alieffson
  • 2,672
  • 29
  • 34