title: Best way to escape strings for sql inserts?
body: <p>What is the best way to escape strings for sql inserts, updates?</p>
  
  <p>I want to allow special characters including ' and ".  Is the best way to search and replace each string before I use it in an insert statement?</p>
  
  <p>Thanks</p>
  
  <p>Duplicate of: <a href="https://stackoverflow.com/questions/568995/best-way-to-defend-against-mysql-injection-and-cross-site-scripting">Best way to defend against mysql injection and cross site scripting</a></p>