title: how does mysql interpret escaped string?
body: <pre><code>&lt;?php
  $user = 'john';
  $pwd = "' OR ''='";
  $sql = "SELECT * FROM users WHERE
  user='" . $user . "' AND password='" . $pwd . "'";
  echo $sql.'&lt;br /&gt;';
  // escape username and password for use in SQL
  $user = mysql_real_escape_string($user);
  $pwd = mysql_real_escape_string($pwd);
  
  $sql_escaped = "SELECT * FROM users WHERE
  user='" . $user . "' AND password='" . $pwd . "'";
  
  echo $sql_escaped;
  ?&gt; 
  </code></pre>
  
  <p>It shows: </p>
  
  <pre><code>SELECT * FROM users WHERE user='john' AND password='' OR ''=''
  SELECT * FROM users WHERE user='john' AND password='\' OR \'\'=\'' 
  </code></pre>
  
  <p>Question:</p>
  
  <p>How does mysql interpret this line: <code>password='\' OR \'\'=\''</code>? <code>password</code> equals <code>\</code> or what?</p>