Php: I need to insert one & within my mysql database
<p>I'm having trouble with the ampersand symbol, because I've to allow user to insert page_title within database.
The problem is that in my mother language many companies have the symbol in their names like per example "Santos &amp; Filhos".</p>

<p>The question is, how can I insert this, without break my database and without opening security issues?</p>

<p>using this the database gets broken</p>

<pre><code>$title = preg_replace('/&amp;/', '&amp;amp;', $title);
$final_title = utf8_encode($title);
</code></pre>

<p>I'm using utf8_encode because of the other accents like á or ã</p>

<p>Thanks, hope you can help me here</p>

<hr>

<h2>EDIT</h2>

<p>ok, first thanks to all, most of you were wright, mysql_real_escape_string is indeed one of the best options, if not the best.</p>

<p>I discovered that I was missing one escape (in query) before  post my variables to be processed by php and inserted within the database.</p>

<p>So I manage to get my &amp; but now I can't manage to have accents...</p>

<p>So far my php code looks like this</p>

<pre><code>$title = mysql_real_escape_string($_POST['title']);
$sql = "UPDATE bodytable SET body_title = '".utf8_encode($title)."'";
</code></pre>

<p>and then in my frontage I've </p>

<pre><code>utf8_decode($row['body_title']);
</code></pre>

<p>the result is</p>

<pre><code>&lt;title&gt;Santos &amp; Filhos - Repara?es de autom?veis&lt;/title&gt;
</code></pre>
