unsigned long mysql_real_escape_string(MYSQL *mysql, char *to, const char *from, unsigned long length)
This function creates a legal SQL string for use in an SQL statement. SeeString Literals.
mysql_real_escape_string()
fails and produces anCR_INSECURE_API_ERR
error if theNO_BACKSLASH_ESCAPES
SQL mode is enabled. In this case, the function cannot escape quote characters except by doubling them, and to do this properly, it must know more information about the quoting context than is available. Instead, usemysql_real_escape_string_quote()
, which takes an extra argument for specifying the quoting context.
Themysql
argument must be a valid, open connection because character escaping depends on the character set in use by the server.
The string in thefrom
argument is encoded to produce an escaped SQL string, taking into account the current character set of the connection. The result is placed in theto
argument, followed by a terminating null byte.
Characters encoded are\
,'
,"
,NUL
(ASCII 0),\n
,\r
, and Control+Z. Strictly speaking, MySQL requires only that backslash and the quote character used to quote the string in the query be escaped.mysql_real_escape_string()
quotes the other characters to make them easier to read in log files. For comparison, see the quoting rules for literal strings and theQUOTE()
SQL function inString Literals, andString Functions and Operators.
The string pointed to byfrom
must belength
bytes long. You must allocate theto
buffer to be at leastlength*2+1
bytes long. (In the worst case, each character may need to be encoded as using two bytes, and there must be room for the terminating null byte.) Whenmysql_real_escape_string()
returns, the contents ofto
is a null-terminated string. The return value is the length of the encoded string, not including the terminating null byte.
If you must change the character set of the connection, use themysql_set_character_set()
function rather than executing aSET NAMES
(orSET CHARACTER SET
) statement.mysql_set_character_set()
works likeSET NAMES
but also affects the character set used bymysql_real_escape_string()
, whichSET NAMES
does not.
The following example inserts two escaped strings into anINSERT
statement, each within single quote characters:
char query[1000],*end; end = my_stpcpy(query,"INSERT INTO test_table VALUES('"); end += mysql_real_escape_string(&mysql,end,"What is this",12); end = my_stpcpy(end,"','"); end += mysql_real_escape_string(&mysql,end,"binary data: \0\r\n",16); end = my_stpcpy(end,"')"); if (mysql_real_query(&mysql,query,(unsigned int) (end - query))) { fprintf(stderr, "Failed to insert row, Error: %s\n", mysql_error(&mysql)); }
Themy_stpcpy()
function used in the example is included in thelibmysqlclient
library and works likestrcpy()
but returns a pointer to the terminating null of the first parameter.
The length of the encoded string that is placed into theto
argument, not including the terminating null byte, or -1 if an error occurs.
Becausemysql_real_escape_string()
returns an unsigned value, you can check for -1 by comparing the return value to(unsigned long)-1
(or to(unsigned long)~0
, which is equivalent).
This error occurs if the
NO_BACKSLASH_ESCAPES
SQL mode is enabled because, in that case,mysql_real_escape_string()
cannot be guaranteed to produce a properly encoded result. To avoid this error, usemysql_real_escape_string_quote()
instead.