What is the use of mysql_real_escape_string function?

Question

I have started learning PHP and got a thought about mysql.

I did google and found this stack overflow link
http://stackoverflow.com/questions/625930/what-is-the-maximum-size-of-a-mysql-database-in-version-5-and-up

But there are less answers and more discussions. Can someone give me the right answer which has full description in it.

Answer 1

The mysql_real_escape_string() function escapes special characters in a string for use in an SQL statement

The following characters are affected:

1. \x00
2. \n
3. \r
4. \
5. '
6. "
7. \x1a

Syntax

mysql_real_escape_string(string,connection)

So you can't escape entire query, just data... because it will escape all unsafe characters like quotes (valid parts of query).

If you try something like that (to escape entire query)

Example :

mysql_real_escape_string("INSERT INTO some_table VALUES ('xyz', 'abc', '123');");

Output:

INSERT INTO some_table VALUES (\'xyz\', \'abc\', \'123\');

Answer 2

mysql_real_escape_string — Escapes special characters in a string for use in an SQL statement.
It is used to avoid the SQL injection attacks. Like it makes only the authorized user to log into the account.