Quote:
Originally Posted by cbk1994
" (quotation marks) don't need to be escaped in MySQL either. Can you please fix it?
|
Double quotes are used in the SQL syntax as identifers (like backticks: `). MySQL doesn't follow that specification if the ANSI_QUOTES SQL mode isn't enabled. Instead, MySQL uses them as string quotes in that case (like single quotes: ').
So really, the proper way to go about this is always use single quotes and only escape single quotes (go ahead and make your own function). But escaping both leaves no room for injection, only room for extra backslashes, which can be fixed.