When should special characers be escaped inside strings?

srbakshi

Hi all. I picked up the following code example from the php manual:

Expand|Select|Wrap|Line Numbers

 
$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')

    OR die(mysql_error());
 
// Query

$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",

            mysql_real_escape_string($user),

            mysql_real_escape_string($password));

My question is, shouldn't we be escaping the ' in the sprintf statement with backslashes? Like this? -->

Expand|Select|Wrap|Line Numbers

 $query = sprintf("SELECT * FROM users WHERE user=\'%s\' AND password=\'%s\'",

            mysql_real_escape_string($user),

            mysql_real_escape_string($password));

I'm kind of confused with all this. When are we supposed to put the backslashes?? Please somebody help.

Also, while you pros are at it, I'll really appreciate it if you could tell me if these two strings are the same:

String A:

Expand|Select|Wrap|Line Numbers

char A[] = "Hello. 'How are you' "

String B:

Expand|Select|Wrap|Line Numbers

char B[] = "Hello. \'How are you\'"

Because both print Hello. 'How are you' on the screen on using printf.
Also, both have the same string lengths.

I'm wondering why we need to escape the 's at all if they print the same string and are of the same length as well.

Sorry if the question is uber-dumb.
Thanks in advance,
Sid

Atli

Hi.

If you open a string using double-quotes, there is no need to escape single-quotes inside that string. (And the other way around.)

However, both will accept the escaped versions and convert them into their respective characters, just like they are supposed to.

Expand|Select|Wrap|Line Numbers

 
// Both print exactly the same: John's name

echo "John's name";

echo "John\'s name";

The only time you really need to escape a quote character is if it is within a string that it would otherwise close.
Like a single-quote inside a single-quoted string.

Expand|Select|Wrap|Line Numbers

 
echo 'John's name'; // Gives a parse error

echo  'John\'s name'; // Works
 
echo "John said: "What?""; // Gives a parse error

echo "John said: \"What?\""; // Correct

Does that answer you question?

Edit.
Looking closer at your bottom examples, they look like C/C++?
In PHP, both strings would print the single-quotes as if the escape characters weren't there. In C/C++ however, I do not know.

Markus

When dealing with SQL, you should always escape special characters.

srbakshi

Thank you atli and Markus. That helped. :)
-Sid

When should special characers be escaped inside strings?

re: When should special characers be escaped inside strings?

re: When should special characers be escaped inside strings?

re: When should special characers be escaped inside strings?

Similar PHP bytes

/bytes/development

/bytes/it

/bytes/about