title: MySQL QUOTE() vs mysql_real_escape_string()?
body: <p>In MySQL, what are the differences between <code>QUOTE()</code> and <code>mysql_real_escape_string()</code>? From the MySQL documentation, I know the following:</p>
  
  <p><strong>QUOTE()</strong></p>
  
  <ul>
  <li>Written into SQL query</li>
  <li>Escapes backslash, single quote, NUL, CTRL+Z</li>
  <li>Returns a single-quoted string</li>
  <li>Behavior relies on the MySQL server's character set</li>
  </ul>
  
  <p><strong>mysql_real_escape_string()</strong></p>
  
  <ul>
  <li>Written in C/C++ before a query is executed, allowing the escaped string to be read/modified before submission</li>
  <li>Very inconvenient to use when compared to <code>QUOTE()</code></li>
  <li>Escapes backslash, single quote, NUL, CTRL+Z, and <strong>double quote, \n, and \r</strong></li>
  <li>Apparently adds more quotes to make characters easily readable in log files</li>
  <li>Behavior relies on the MySQL server's character set</li>
  </ul>
  
  <p>Ignoring logs, is it useful to escape <code>\n</code> and <code>\r</code> characters? With these two functions, is there a difference in client/server function efficiency? <code>mysql_real_escape_string()</code> sounds useful if it's desirable for a developer to process the escaped string before it's entered into a query. However, does <code>QUOTE()</code> not provide the most secure and reliable method of escaping strings?</p>
  
  <p>I wonder if I should use <code>QUOTE()</code> for all queries in all languages and forget escaping strings with language-specific functions.</p>
  
  <hr>
  
  <ul>
  <li><a href="http://dev.mysql.com/doc/refman/5.0/en/string-functions.html#function_quote" rel="noreferrer">QUOTE()</a></li>
  <li><a href="http://dev.mysql.com/doc/refman/5.0/en/mysql-real-escape-string.html" rel="noreferrer">mysql_real_escape_string()</a></li>
  <li><a href="http://dev.mysql.com/doc/refman/5.0/en/string-literals.html" rel="noreferrer">String Literals</a></li>
  </ul>