Why does my mysql_real_escape_string not work(PHP) ?

Question

hello,

I have read many about SQL-Injection". But it does not work with this code:

$inputform= $_GET["password"];
$query = "INSERT INTO user(password) VALUES ('".mysql_real_escape_string($inputform)."')";  

For example I use this example: O'Conner. When I submit it and look in my table there is O'Connor and not O\'Conner.

thanks

Answer 1

The quote is escaped so that MySQL doesn't interpret it as a string delimiter. The backslash doesn't get stored in the database, and it's not supposed to either. What you're seeing is the correct, expected and documented behaviour.

The best solution, BTW, is to use PDO and parametrized queries.

Answer 2

mysql_real_escape_string() escapes the value so that the SQL parser for MySQL can interpret the value correctly when it stores the value, it is not actually stored in the database as an escaped string

Answer 3

If you get O'Connor in your table, it's working properly. But try echo $query and you'll see the results of the escaping.

Answer 4

It works just fine! There shouldn't be "O\'Conner" in your database, just in the query. If it didn't work, your query wouldn't succeed, because the ' in O'Conner would ruin your query.

Answer 5

When you look in the table, it should be O'Connor - that means the string was escaped properly in the SQL. If it hadn't been escaped by mysql_real_escape_string, you probably would have ended up with a syntax error.

The query would end up as:

INSERT INTO user(password) VALUES ('O'Connor)

If you want the backslashes in the DB, try using addslashes before you pass it to mysql_real_escape_string, but you probably don't.

Answer 6

Thanks!Is mysql_real_escape_string secure enough? How can I test,for example, a login-system(SELECT....)?