to reproduce) call db_query with %s and single quote in the string
what happens) single quote replaced with two single quotes
what should happen) single quote replaced with backslash+single quote.

For mysql at least this is true. single quote s/b replaced with 2 single quotes. Instead it is replaced with backslash+quote. using mysql on both Linux and Windows and Drupal 6.4. Mysql version is 5.1.11.

Comments

pre911mindset’s picture

pre911mindset commented

Sorry I got this perfectly backwards. What I meant to say:

what should happen) single quote replaced with two single quotes
what happens ) single quote replaced with backslash+single quote.

phpdiva’s picture

phpdiva commented
Status: Active » Closed (works as designed)

I'm not a MySQL guru by any means, but I've never seen a single quote escaped by replacing it with two single quotes. I've always seen the backslash method.

From looking at the MySQL manual looks like both ways are acceptable.

There are several ways to include quote characters within a string:
* A “'” inside a string quoted with “'” may be written as “''”.
* A “"” inside a string quoted with “"” may be written as “""”.
* Precede the quote character by an escape character (“\”).
* A “'” inside a string quoted with “"” needs no special treatment and need not be doubled or escaped. In the same way, “"” inside a string quoted with “'” needs no special treatment.

Just from personal experience, backslash seems to be quite a bit more common. There might have been other reasons for selecting this method of escaping, but I'm sure this is by design.