title: How to manually prevent sql injection by escaping strings inserted into MySQL statements
body: <p>I need to generate MySQL INSERT and UPDATE statements from a text list of string parameters. It's basically a matter of inserting strings into placeholders, like so:</p>
  
  <p>Input file</p>
  
  <pre><code>apple
  banana
  orange
  </code></pre>
  
  <p>Script (imagine a simple Ruby or Python program or Bash script) generates output:</p>
  
  <pre><code>INSERT INTO fruits (name) values ('apple');
  INSERT INTO fruits (name) values ('banana');
  INSERT INTO fruits (name) values ('orange');
  </code></pre>
  
  <p>This output will then be saved to a file which will later be piped into STDIN of the <code>mysql</code> command to update a database, much like one uses output from <code>mysqldump</code>.</p>
  
  <p>But I would like to add some code to prevent either accidental or intentional SQL injection. I assume that this begins with prepending a backslash before any single quote character or backslash character in the input file entries. Is there anything else that needs to be done? I used this webpage as reference: <a href="http://dev.mysql.com/doc/refman/5.0/en/mysql-real-escape-string.html" rel="nofollow">http://dev.mysql.com/doc/refman/5.0/en/mysql-real-escape-string.html</a></p>