mysql_escape_string VS mysql_real_escape_string

问题:

So this is something we all should know about, and played on my mind when I first seen it..

I know that mysql_escape_string is deprecated from 5.3 but what was the actual difference in mysql_real_escape_string.

What I thought was that mysql_real_escape_string is the exact same as mysql_escape_string apart from mysql_real_escape_string takes a second argument for the mysql resource.

so then I thought well surly there must be some difference as to how strings are handled because there would not be a need for 2 functions.

So then I thought that the difference was purely down to locale and character encodings. ?

can anyone clear this up for me ?

回答1:

The difference is that mysql_escape_string just treats the string as raw bytes, and adds escaping where it believes it's appropriate.

mysql_real_escape_string, on the other hand, uses the information about the character set used for the MySQL connection. This means the string is escaped while treating multi-byte characters properly; i.e., it won't insert escaping characters in the middle of a character. This is why you need a connection for mysql_real_escape_string; it's necessary in order to know how the string should be treated.

However, instead of escaping, it's a better idea to use parameterized queries from the MySQLi library; there has previously been bugs in the escaping routine, and it's possible that some could appear again. Parameterizing the query is much, much harder to mess up, so it's less likely that you can get compromised by a MySQL bug.

回答2:

mysql_escape_string is not deprecated from 5.3 but, for 4.3.0 and above. So any One using PHP version above/or 4.3.0 should use mysql_real_escape_string.

if using php < 4.3.0, than make your magic_quotes_gpc active from php.ini, though it is recommended to update, but if your code will have problem than make sure you use, magic_quotes_gpc and addslash function rather than mysql_escape_string.

回答3:

Well... sort of, yes. It takes the character set of the MySQL connection into account.

http://php.net/mysql_escape_string

This function is identical to mysql_real_escape_string() except that mysql_real_escape_string() takes a connection handler and escapes the string according to the current character set. mysql_escape_string() does not take a connection argument and does not respect the current charset setting.

回答4:

now both of these functions are deprecated in

PHP 4 >= 4.3.0 and PHP 5. They recommend using PDO_MySQL extension