mysql_escape_string VS mysql_real_escape_string

Question

I know that mysql_escape_string is deprecated from 5.3 but what was the actual difference in mysql_real_escape_string.

What I thought was that mysql_real_escape_string is the exact same as mysql_escape_string apart from mysql_real_escape_string takes a second argument for the mysql resource.

So then I thought well surely there must be some difference as to how strings are handled because there would not be a need for 2 functions.

So then I thought that the difference was purely down to locale and character encodings?

Cherycherye

Answer 1

The difference is that mysql_escape_string just treats the string as raw bytes, and adds escaping where it believes it's appropriate.

mysql_real_escape_string, on the other hand, uses the information about the character set used for the MySQL connection. This means the string is escaped while treating multi-byte characters properly; i.e., it won't insert escaping characters in the middle of a character. This is why you need a connection for mysql_real_escape_string; it's necessary in order to know how the string should be treated.

However, instead of escaping, it's a better idea to use parameterized queries from the MySQLi library; there has previously been bugs in the escaping routine, and it's possible that some could appear again. Parameterizing the query is much, much harder to mess up, so it's less likely that you can get compromised by a MySQL bug.

Oedema

i use PDO, this was just something that I needed to know for educational purposes . – Cherycherye

There's also a mysqli_escape_string(). Does also do the same thing as mysql_escape_string?? if mysql_escape_string is deprecated why there's this function available and in mysqli too??? – Deledda

@Lykos: mysqli_escape_string is an alias for mysqli_real_escape_string, so the problem only applies to the old mysql_* functions. I would assume this was done as a convenience for people migrating from mysql to mysqli. – Oedema

So either mysqli_escape_string() or mysqli_real_escape_string() both do the same thing, right? – Deledda

@Lykos: Correct, but as I write in the answer, you should really prefer parameterized queries over escaping. If you must, however, then you can use either - but I would probably prefer using mysqli_real_escape_string, just so you don't inadvertantly introduce a bug if you for some reason need to modify the script to run on a server that only has the old mysql module. – Oedema

Answer 2

Well... sort of, yes. It takes the character set of the MySQL connection into account.

http://php.net/mysql_escape_string

This function is identical to mysql_real_escape_string() except that mysql_real_escape_string() takes a connection handler and escapes the string according to the current character set. mysql_escape_string() does not take a connection argument and does not respect the current charset setting.

Pali

Answer 3

mysql_escape_string is not deprecated from 5.3 but, for 4.3.0 and above. So any One using PHP version above/or 4.3.0 should use mysql_real_escape_string.

if using php < 4.3.0, than make your magic_quotes_gpc active from php.ini, though it is recommended to update, but if your code will have problem than make sure you use, magic_quotes_gpc and addslash function rather than mysql_escape_string.

Materialist

Answer 4

now both of these functions are deprecated in

PHP 4 >= 4.3.0 and PHP 5. They recommend using PDO_MySQL extension

Faraday