title: Escaping MySQL wild cards
body: <p>On an older server I'm using that I can't use prepared statements on I am currently trying to fully escape user input before sending it to MySQL.
  For this I am using the PHP function <code>mysql_real_escape_string</code>.</p>
  
  <p>Since this function does not escape the MySQL wildcards % and _ I am using <code>addcslashes</code> to escape these as well.</p>
  
  <p>When I send something like:</p>
  
  <pre><code>test_test " ' 
  </code></pre>
  
  <p>to the database and then read it back the database shows:</p>
  
  <pre><code>test\_test " ' 
  </code></pre>
  
  <p>Looking at this I can't understand why the _ has a preceding backslash but the " and ' don't.
  Since they are all escaped with \ surely _ ' and " should all appear the same, i.e. all have the escape character visible or all not have it visible.</p>
  
  <p>Are the escaping \s automatically screened out for </p>
  
  <p>Can anyone explain this?</p>