Just wondering, to sanitize user input, I use mysql\_real\_escape\_string() on data before it is inserted into a table. Therefore when a user enters something like this:

```
Hi I'm just testing this

```

It gets placed into the table just fine, exactly as above. Question is, if I were to pull that data and place it into a variable via PHP, say $string, what would happen if I then used that variable to insert data into a new row in the table? Such as:

```
<?php

$result = mysql_query( "SELECT data FROM table WHERE id='1'" ); //data = Hi I'm just testing this
$result_array = mysql_fetch_array( $result );

$string = $result_array['data'];  //string = Hi I'm just testing this

$insert = mysql_query( "INSERT INTO table (data) VALUES ('$string')" ) or die(mysql_error());

?>

```

Would the single quote (') cause problems in this scenario? Should I be using $string = mysql\_real\_escape\_string( $result\_array['data'] ) in this case as well?

Thanks!