title: What characters have to be escaped to prevent (My)SQL injections?
body: <p>I'm using MySQL API's function</p>
  
  <pre><code>mysql_real_escape_string()
  </code></pre>
  
  <p>Based on the documentation, it escapes the following characters:</p>
  
  <pre><code>\0
  \n
  \r
  \
  '
  "
  \Z
  </code></pre>
  
  <p>Now, I looked into OWASP.org's ESAPI security library and in the Python port it had the following code (<a href="http://code.google.com/p/owasp-esapi-python/source/browse/esapi/codecs/mysql.py" rel="noreferrer">http://code.google.com/p/owasp-esapi-python/source/browse/esapi/codecs/mysql.py</a>):</p>
  
  <pre><code>        """
          Encodes a character for MySQL.
          """
          lookup = {
          0x00 : "\\0",
          0x08 : "\\b",
          0x09 : "\\t",
          0x0a : "\\n",
          0x0d : "\\r",
          0x1a : "\\Z",
          0x22 : '\\"',
          0x25 : "\\%",
          0x27 : "\\'",
          0x5c : "\\\\",
          0x5f : "\\_",
          }
  </code></pre>
  
  <p>Now, I'm wondering whether all those characters are really needed to be escaped. I understand why % and _ are there, they are meta characters in LIKE operator, but I can't simply understand why did they add backspace and tabulator characters (\b \t)? Is there a security issue if you do a query:</p>
  
  <pre><code>SELECT a FROM b WHERE c = '...user input ...';
  </code></pre>
  
  <p>Where user input contains tabulators or backspace characters?</p>
  
  <p>My question is here: Why did they include \b \t in the ESAPI security library? Are there <em>any</em> situations where you might need to escape those characters?</p>