Take the 2-minute tour ×

i want to search mc'd in my database,but i use mysql_real_escape_string

but nothing found bcos it will output mc\\'d

any idea,

share|improve this question
add comment

3 Answers

mysql_real_escape_string should return single quotes escaped with only one backslash, so my wild guess is that you have magic_quotes_gpc turned on in your php.ini. Turn that off, and it'll be ok.

share|improve this answer
magic_quotes_gpc is deprecated anyway, so it's good to turn it off. –  Wyzard Jan 18 '10 at 8:08
add comment

Consider using PHP Data Objects instead of mysql_query(). Then you don't need mysql_real_escape_string(), because PDO takes care of correct parameter passing internally. (It'll use bind parameters if the database supports them, otherwise it'll do the escaping for you.)

This is safer, from an SQL injection standpoint, than constructing raw query strings by hand and having to remember to escape everything. The parameter values are given separately from the SQL so there's no possibility of malicious input changing the structure of the query.

share|improve this answer
add comment

Use addslashes while inserting in the database and use stripslashes while fetching from the database.

and in your condition its adding two slashes to ' so i think it is due to you magic quote is on.

So it will be better if you turn off the magic quote and then make the search.

So after turn off the magic quote it will give md'c --> md\'c.

Hope this will helpful for u..

share|improve this answer
The addslashes function is a very poor method of escaping data for SQL queries. Undoubtedly one of the more dangerous methods available. - You should use the mysql_real_escape_string function, or better yet, the method suggested by Wyzard. –  Atli Jan 18 '10 at 17:55
add comment

Your Answer


