title: Escaping quotes in SQL
body: <p>According to php.net I should use  <a href="http://php.net/manual/en/function.mysql-real-escape-string.php" rel="nofollow noreferrer">mysql_real_escape_string()</a> and turn off <a href="http://www.php.net/manual/en/security.magicquotes.whynot.php" rel="nofollow noreferrer">magic quotes</a>, because it's deprecated.</p>
  
  <p>So I turned it off and I used mysql_real_escape_string(), but is it enough to use it just like in the following code?</p>
  
  <pre><code>$value = "It's Time!";
  $escaped_value = mysql_real_escape_string($value);
  
  mysql_query("INSERT INTO table (column, column2) VALUES ('{$escaped_value}', "0")");
  </code></pre>
  
  <p>When I check the data in the database it looks the same way as in $value so <code>"It's Time"</code> and not <code>"It\'s Time"</code>. Is this normal? Shouldn't this add a slash before the quotes?</p>