MySQL in a Nutshell, 2nd Edition

Name

mysql_escape_string()

Synopsis

string mysql_escape_string(string)

This function returns the string given with special characters preceded by backslashes so that they are protected from being interpreted by the SQL interpreter. This function is used in conjunction with mysql_query() to help make SQL statements safe. However, it is deprecated, so use mysql_real_escape_string() instead. Here is an example:

...
$clientid = '1000';
$description = "Can't connect to network.";
$description = mysql_escape_string($description);
$sql_stmnt = "INSERT INTO workreq
              (date, clientid, description)
              VALUES(NOW( ), '$clientid', '$description')";
mysql_query($sql_stmnt);
...

The string contained in the $description variable contains an apostrophe, which would normally cause the SQL statement to fail because the related value in the SQL statement is surrounded by single quotes. Without mysql_escape_string(), an apostrophe would be mistaken for a single quote, which has special meaning in MySQL.