mysql_real_escape_string() and UTF8

[chros]

Hello!

I have a problem (?):
XHTML is UTF8 encoded, MySQL DB is UTF8, in PHP after the connection is established: mysql_query("SET NAMES 'utf8'", $dbh);
The characters are properly displayed in the browser and in 'MySQL Query Browser' (from mysql.com).

The problem is: when I post a data eg: 'foo"bar"foo' from a form and insert into the db with this myqsl_query("INSERT...".mysql_real_escape_string($_POST['field']));
and looked in the 'MySQL Query Browser' the " characters aren't escaped (not \")!!!

OR did I misunderstood something ?

Edit: PHP v4.3.11 , MySQL 4.1.18 , OS WinXP SP2

[MarkR]

Double quotes do not need to be escaped in MySQL literal strings.

The only characters which normally need to be escaped are single quotes and backslashes (although I'm not 100% sure about nulls).

If in doubt, use prepared queries (and PDO) - and of course upgrade to a less archaeological version of PHP.

Using a prepared query (With PDO or mysqli) will ensure that the fields are completely correctly escaped (or will use a protocol where escaping them is unnecessary). For binary data, I'd strongly recommend it.

Mark

[chros]

It was a false alarm, everything is working fine. Perhaps I was going crazy because of the lot of work 🙂 .