Am I using mysqli_real_escape_string correctly?

Question

I'm escaping a string using the OOP method of mysqli_real_escape_string . I saved the input being entered into a session variable to make sure it's escaping correctly. It seems to be escaping correctly, but when I check what gets entered into the database I don't see the slashes before single and double quotes.

So in the browser I echo:

Array
(
    [formContent] => I\'m always here!
)

But in the database I see:

I'm always here!

Does this mean there's something wrong with my code somewhere?

Answer 1

No, it's normal. mysqli_real_escape_string automatically escape the single quote for you.

When you have the string,

I'm always here!

mysqli_real_escape_string processed it as

I\'m always here!

so it will be saved on the database. That's how it works.

Answer 2

mysqli_real_escape_string — Escapes special characters in a string for use in an SQL statement, taking into account the current charset of the connection

what it does it escape single quote (save from sql injection at some level)

hello 'world

mysqli_real_escape_string processed it as

hello \'world

you can use stripslashes to remove \\