mysql_real_escape_string()

You can call the mysql_real_escape_string() function to encode the special characters in a string of a statement, so as to create a valid string for use in an SQL statement.

Syntax

unsigned long
mysql_real_escape_string(MYSQL *mysql,
                         char *to,
                         const char *from,
                         unsigned long length)

Arguments

• The mysql argument must be a valid and open connection because character escaping depends on the character set used by the server.

• The string in the from argument is encoded to generate an escaped SQL string. The result is placed in the to argument, followed by a terminating null character.

• The length of the string that from points to must be length bytes. At least length*2+1 bytes must be allocated to the buffer. (In the worst case, each character may need to be encoded by using two bytes, and room must be reserved for the terminating null character.) When mysql_real_escape_string() returns, the content of to is a null-terminated string. The return value is the length of the encoded string, excluding the terminating null character.

Return values

The length of the encoded string that is placed into the to argument is returned, excluding the terminating null character.

Errors

None.

Notes

Characters encoded are \, ', ", NUL (ASCII 0), \n, \r, and Control+Z. OceanBase requires only to escape the backslash and the quote character used to quote the string in a query.

mysql_real_escape_string() can quote other characters to make them easier to read in log files.

If the character set of the connection must be changed, use the mysql_set_character_set() function rather than executing a SET NAMES (or SET CHARACTER SET) statement. mysql_set_character_set() is similar to SET NAMES in functionality, but it affects the character set used by mysql_real_escape_string() and SET NAMES does not.