PHP pg_escape_literal() Function: Usage and Examples

pg_escape_literal() escapes and quotes a text value as a complete PostgreSQL SQL literal. This guide explains the function with focused examples and the decisions that matter in real applications.

What Is pg_escape_literal() in PHP?

Escapes and quotes a text value as a complete PostgreSQL SQL literal.

A typical call looks like this:

<?php

pg_escape_literal($databaseConnection, "O'Reilly");

The input arguments shown in the call identify the relevant connection, resource, value, path or configuration for the operation. Pay attention to argument order and to the return value demonstrated below.

In the examples, $databaseConnection is a PostgreSQL connection created with pg_connect(). A $queryResult is produced by pg_query(). Large-object handles are transaction-scoped. A false result should be treated as a failed operation, not as empty data.

Example 1: Basic Usage

This first example uses pg_escape_literal() directly to demonstrate its basic purpose.

<?php

$connectionString = getenv("PG_CONNECTION_STRING");
if (!$connectionString) { throw new RuntimeException("Configure PG_CONNECTION_STRING first."); }
$databaseConnection = pg_connect($connectionString);
if ($databaseConnection === false) { throw new RuntimeException("Connection failed."); }
$columnName = "display name";
$searchTerm = "Sam's notes";

$result = pg_escape_literal($databaseConnection, "O'Reilly");
var_dump($result);

This call works with the particular connection or result object created above. The exact rows or database diagnostics depend on the example database.

Example 2: A Different Input or Option

The next example changes the input or option, showing another supported use of pg_escape_literal().

<?php

$connectionString = getenv("PG_CONNECTION_STRING");
if (!$connectionString) { throw new RuntimeException("Configure PG_CONNECTION_STRING first."); }
$databaseConnection = pg_connect($connectionString);
if ($databaseConnection === false) { throw new RuntimeException("Connection failed."); }
$columnName = "display name";
$searchTerm = "Sam's notes";

$result = pg_escape_literal($databaseConnection, "Active");
var_dump($result);

This call works with the particular connection or result object created above. The exact rows or database diagnostics depend on the example database.

Practical Example: Applying the Function

In application code, pg_escape_literal() belongs in a controlled workflow with input validation, a checked result and cleanup where needed.

<?php

$connectionString = getenv("PG_CONNECTION_STRING");
if (!$connectionString) { throw new RuntimeException("Configure PG_CONNECTION_STRING first."); }
$databaseConnection = pg_connect($connectionString);
if ($databaseConnection === false) { throw new RuntimeException("Connection failed."); }
$columnName = "display name";
$searchTerm = "Sam's notes";

$result = pg_escape_literal($databaseConnection, $searchTerm);
var_dump($result);

This call works with the particular connection or result object created above. The exact rows or database diagnostics depend on the example database.

Important Behavior and Edge Cases

• Main behavior: Escapes and quotes a text value as a complete PostgreSQL SQL literal.
• Important limitation: Prepared statements are safer for application values; never concatenate untrusted SQL structure.
• Requirements: PostgreSQL must be available, the pgsql extension must be enabled, and the connection must have suitable privileges.

Comparison With Related Functions

Common Beginner Mistakes

Key Takeaways

• Escapes and quotes a text value as a complete PostgreSQL SQL literal.
• Prepared statements are safer for application values; never concatenate untrusted SQL structure.
• PostgreSQL must be available, the pgsql extension must be enabled, and the connection must have suitable privileges.

Use pg_escape_literal() when its behavior matches your task, and verify the relevant return value before taking further action. These examples are illustrative and require an existing PostgreSQL database containing the named example tables; do not run them against production data.