title: PHP/MySQL - Best use and practice of escaping strings
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php">Best way to prevent SQL Injection in PHP</a>  </p>
  </blockquote>
  
  
  
  <p>What is the best way to escape strings when making a query?
  mysql_real_escape_string() seems good but I do not exactly know how to use it in properly.</p>
  
  <p>Does this code do the job properly?</p>
  
  <pre><code>&lt;?php
     /* Let's say that the user types "'#""#''"\{(})#&amp;/\€ in a textfield */
     $newStr = mysql_real_escape_string($str);
     $query = "INSERT INTO table username VALUES ($str)";
     mysql_query($query);
  ?&gt;
  </code></pre>
  
  <p>EDIT:</p>
  
  <p>Now I have this code:</p>
  
  <pre><code>      $email = $_POST['email'];
      $displayName = $_POST['displayName'];
      $pass = $_POST['pass1'];
  
      $email = mysqli_real_escape_string($link, $email);
      $displayName = mysqli_real_escape_string($link, $displayName);
      $pass = mysqli_real_escape_string($link, $pass);
  
      $insert = "INSERT INTO profiles (email, displayName, password)
      VALUES ('$email', '$displayName', md5('$pass'))";
      mysqli_query($link, $insert)
      or die(mysqli_error($link));
  </code></pre>
  
  <p>But I get this error:
  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '<em>!"#!#^!"#!"</em>#!"#^'''''' at line 1</p>
  
  <p>If the user enters:
  '**!"#!#^!"#!"*#!"#^''''</p>