1

How to escape column' special characters in SQL select statement.

I have that sql select statement and the column account_name has values that contains special characters, it gives me error as it doesn't escape those special characters.

select * from account where account_name ='$account_name'
Cœur
  • 34,719
  • 24
  • 185
  • 251
user2095570
  • 1
  • 2

2 Answers2

2

Don't use any of the MySQL extension commands, they are obsolete and not recommended anymore.

use PDO and prepared atatements.

http://php.net/pdo

$name = '$somethingHere';
$stmt = $db->prepare("Select * from account where account_name = :name");
$stmt->bindValue(':name', $name, PDO::PARAM_STR);
$stmt->execute();
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
Andrew
  • 12,347
  • 1
  • 31
  • 47
1

Use mysql_real_escape_string($account_name) function.

Bud Damyanov
  • 27,507
  • 6
  • 41
  • 51