PHP Mysqli::real_escape_string() Method: Usage and Examples

Escapes a string for safe inclusion in a MySQL string literal under the current charset.

The examples focus on the operation itself, including the important distinction: prepare with bound parameters avoids manual SQL-string escaping.

What It Does

Use the examples below to observe the behavior on a small dataset before extending it to application code.

Syntax and Return Value

Mysqli::real_escape_string(...) — requires the corresponding optional extension

The displayed signature describes the API or identifies any correction or optional dependency. When a parameter is optional, supply it only when the task requires it.

Example 1: Basic Use

Examples assume a demo database containing users(id, email, active), products(id, name, price), and orders(id, user_id, total) as required by the query. The escaping example is illustrative only: prefer bound parameters for SQL values.

<?php
$mysqli = new mysqli(getenv('DB_HOST') ?: '127.0.0.1', getenv('DB_USER') ?: 'app', getenv('DB_PASSWORD') ?: '', getenv('DB_NAME') ?: 'demo');
$mysqli->set_charset('utf8mb4');
$selectedId = 7;
$email = '[email protected]';
$quoted = $mysqli->real_escape_string($email);
echo $quoted;

This example is meant for a configured application environment; output depends on the installed extension, external service, or database contents.

Example 2: Checking Behavior

Examples assume a demo database containing users(id, email, active), products(id, name, price), and orders(id, user_id, total) as required by the query. The escaping example is illustrative only: prefer bound parameters for SQL values.

<?php
$mysqli = new mysqli(getenv('DB_HOST') ?: '127.0.0.1', getenv('DB_USER') ?: 'app', getenv('DB_PASSWORD') ?: '', getenv('DB_NAME') ?: 'demo');
$mysqli->set_charset('utf8mb4');
$selectedId = 12;
$email = '[email protected]';
$quoted = $mysqli->real_escape_string($email);
echo $quoted;

This example is meant for a configured application environment; output depends on the installed extension, external service, or database contents.

Example 3: Practical Example

Examples assume a demo database containing users(id, email, active), products(id, name, price), and orders(id, user_id, total) as required by the query. The escaping example is illustrative only: prefer bound parameters for SQL values.

<?php
$mysqli = new mysqli(getenv('DB_HOST') ?: '127.0.0.1', getenv('DB_USER') ?: 'app', getenv('DB_PASSWORD') ?: '', getenv('DB_NAME') ?: 'demo');
$mysqli->set_charset('utf8mb4');
$selectedId = 24;
$email = '[email protected]';
$quoted = $mysqli->real_escape_string($email);
echo $quoted;

This example is meant for a configured application environment; output depends on the installed extension, external service, or database contents.

Important Behavior and Edge Cases

Escaping is not a replacement for prepared statements, and the connection charset must be correct.

This API is supplied by an optional extension that is not installed in the local test runtime, or requires a different PHP version. The example must be verified in a matching environment.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Escapes a string for safe inclusion in a MySQL string literal under the current charset.
• Escaping is not a replacement for prepared statements, and the connection charset must be correct.
• prepare with bound parameters avoids manual SQL-string escaping.

Use Mysqli::real_escape_string when its documented behavior matches the problem. Test the relevant edge cases in your own runtime before deploying it.