PHP mysqli_real_escape_string() Function: Usage and Examples

Escapes data for a quoted SQL string literal using the connection charset.

The examples focus on the operation itself, including the important distinction: mysqli_prepare binds values separately from SQL source.

What It Does

Use the examples below to observe the behavior on a small dataset before extending it to application code.

Syntax and Return Value

mysqli_real_escape_string(...) — requires the corresponding optional extension

The displayed signature describes the API or identifies any correction or optional dependency. When a parameter is optional, supply it only when the task requires it.

Example 1: Basic Use

Escaping demonstrates literal syntax only; use mysqli_prepare for untrusted values.

<?php
$link = mysqli_connect(getenv('DB_HOST') ?: '127.0.0.1', getenv('DB_USER') ?: 'app', getenv('DB_PASSWORD') ?: '', getenv('DB_NAME') ?: 'demo');
mysqli_set_charset($link, 'utf8mb4');
$email = '[email protected]';
echo mysqli_real_escape_string($link, $email);

This example is meant for a configured application environment; output depends on the installed extension, external service, or database contents.

Example 2: Checking Behavior

Escaping demonstrates literal syntax only; use mysqli_prepare for untrusted values.

<?php
$link = mysqli_connect(getenv('DB_HOST') ?: '127.0.0.1', getenv('DB_USER') ?: 'app', getenv('DB_PASSWORD') ?: '', getenv('DB_NAME') ?: 'demo');
mysqli_set_charset($link, 'utf8mb4');
$email = '[email protected]';
echo mysqli_real_escape_string($link, $email);

This example is meant for a configured application environment; output depends on the installed extension, external service, or database contents.

Example 3: Practical Example

Escaping demonstrates literal syntax only; use mysqli_prepare for untrusted values.

<?php
$link = mysqli_connect(getenv('DB_HOST') ?: '127.0.0.1', getenv('DB_USER') ?: 'app', getenv('DB_PASSWORD') ?: '', getenv('DB_NAME') ?: 'demo');
mysqli_set_charset($link, 'utf8mb4');
$email = '[email protected]';
echo mysqli_real_escape_string($link, $email);

This example is meant for a configured application environment; output depends on the installed extension, external service, or database contents.

Important Behavior and Edge Cases

Prepared statements are safer and easier; charset must be set correctly for manual escaping.

This API is supplied by an optional extension that is not installed in the local test runtime, or requires a different PHP version. The example must be verified in a matching environment.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Escapes data for a quoted SQL string literal using the connection charset.
• Prepared statements are safer and easier; charset must be set correctly for manual escaping.
• mysqli_prepare binds values separately from SQL source.

Use mysqli_real_escape_string when its documented behavior matches the problem. Test the relevant edge cases in your own runtime before deploying it.