PHP pg_escape_string() Function: Usage and Examples

pg_escape_string() escapes text for insertion inside an SQL string literal, without adding surrounding quotes. This guide explains the function with focused examples and the decisions that matter in real applications.

What Is pg_escape_string() in PHP?

Escapes text for insertion inside an SQL string literal, without adding surrounding quotes.

A typical call looks like this:

<?php

pg_escape_string($databaseConnection, "O'Reilly");

The input arguments shown in the call identify the relevant connection, resource, value, path or configuration for the operation. Pay attention to argument order and to the return value demonstrated below.

In the examples, $databaseConnection is a PostgreSQL connection created with pg_connect(). A $queryResult is produced by pg_query(). Large-object handles are transaction-scoped. A false result should be treated as a failed operation, not as empty data.

Example 1: Basic Usage

This first example uses pg_escape_string() directly to demonstrate its basic purpose.

<?php

$connectionString = getenv("PG_CONNECTION_STRING");
if (!$connectionString) { throw new RuntimeException("Configure PG_CONNECTION_STRING first."); }
$databaseConnection = pg_connect($connectionString);
if ($databaseConnection === false) { throw new RuntimeException("Connection failed."); }
$columnName = "display name";
$searchTerm = "Sam's notes";

$result = pg_escape_string($databaseConnection, "O'Reilly");
var_dump($result);

This call works with the particular connection or result object created above. The exact rows or database diagnostics depend on the example database.

Example 2: A Different Input or Option

The next example changes the input or option, showing another supported use of pg_escape_string().

<?php

$connectionString = getenv("PG_CONNECTION_STRING");
if (!$connectionString) { throw new RuntimeException("Configure PG_CONNECTION_STRING first."); }
$databaseConnection = pg_connect($connectionString);
if ($databaseConnection === false) { throw new RuntimeException("Connection failed."); }
$columnName = "display name";
$searchTerm = "Sam's notes";

$result = pg_escape_string($databaseConnection, "a\b");
var_dump($result);

This call works with the particular connection or result object created above. The exact rows or database diagnostics depend on the example database.

Practical Example: Applying the Function

In application code, pg_escape_string() belongs in a controlled workflow with input validation, a checked result and cleanup where needed.

<?php

$connectionString = getenv("PG_CONNECTION_STRING");
if (!$connectionString) { throw new RuntimeException("Configure PG_CONNECTION_STRING first."); }
$databaseConnection = pg_connect($connectionString);
if ($databaseConnection === false) { throw new RuntimeException("Connection failed."); }
$columnName = "display name";
$searchTerm = "Sam's notes";

$result = pg_escape_string($databaseConnection, $searchTerm);
var_dump($result);

This call works with the particular connection or result object created above. The exact rows or database diagnostics depend on the example database.

Important Behavior and Edge Cases

• Main behavior: Escapes text for insertion inside an SQL string literal, without adding surrounding quotes.
• Important limitation: Missing surrounding quotes makes the resulting SQL invalid or unsafe; prefer parameters.
• Requirements: PostgreSQL must be available, the pgsql extension must be enabled, and the connection must have suitable privileges.

Comparison With Related Functions

Common Beginner Mistakes

Key Takeaways

• Escapes text for insertion inside an SQL string literal, without adding surrounding quotes.
• Missing surrounding quotes makes the resulting SQL invalid or unsafe; prefer parameters.
• PostgreSQL must be available, the pgsql extension must be enabled, and the connection must have suitable privileges.

Use pg_escape_string() when its behavior matches your task, and verify the relevant return value before taking further action. These examples are illustrative and require an existing PostgreSQL database containing the named example tables; do not run them against production data.