How to escape strings before insert query? I've used mysql_real_escape_string() to make strings safe before using Drupal.

Must I escape string before inserting it to database? If the answer is yes, then how must I do it?

I use something like this to insert into database:

\Drupal\Core\Database\Database::setActiveConnection('mydb');
$connection = \Drupal\Core\Database\Database::getConnection();
db_insert($table_name)-&gt;fields(array(
'myfield1' =&gt; 'My String',
))-&gt;execute();
\Drupal\Core\Database\Database::setActiveConnection();
No need to worry about escaping. The Drupal database abstraction layer is taking care of query parameter escaping by turning them into placeholders and escaping the data.