Search code examples
phpsqlsql-injectionapostrophe

mssql_escape saves double apostrophe

I am using the function below to escape my string before it is inserted into the DB. Though it actually inserts the double apostrophe into the database, and when I print it out it still has the double apostrophe. What is the right way to print the value out with the original single apostrophe?

function mssql_escape($var){
    if(get_magic_quotes_gpc()){
        $var = stripslashes($var);
    }
    return str_replace("'", "''", $var);
}
Solution

  • Because you are using a parameterised statement there is no need to double up the single quotes. This is the right way of doing things and is generally safe from SQL Injection attacks.