Implementation code for escaping mysql statements in php

It is impossible for you to manually escape every such special character, not to mention what you usually deal with is the content that is automatically submitted by the form.

So, the mysql_real_escape_string function should be used:

mysql_real_escape_string — Escapes special characters in strings used in SQL statements, taking into account the current character set of the connection.

But note: this function does not escape % and _. In addition, it is best not to use this function for the entire SQL statement, but to escape only the string parameters passed into the SQL statement, otherwise unexpected results will occur.

Script example:
The code is as follows:
$item = "Zak's and Derick's Laptop";
$escaped_item = mysql_real_escape_string($item);
printf ("Escaped string: %sn", $escaped_item);
?>