Let me say what I think:
First of all I do not know MySQL is not all types of data can be added single quotation marks, I just tried, in the whole number of integers plus single quotation marks as if there is no problem.
If it is true that any type of data can be enclosed in single quotes, add single quotes to any data when generating the MySQL statement, and then use mysql_escape_string to escape all special characters in the received character. This allows the received string to be completely "restricted" between single quotes.
But even if it seems like it can't be once and for all, because escaping in a string similar to the one after the like clause seems to be different from the normal string. In addition, if any of the updates in the amp involve escaping, there may be a problem. Are there any solutions to these two problems once and for all? Are there any other questions?
Other database all types of data can be added single quotes?
Reply to discussion (solution)
For MySQL nature is no problem
The escape in the string after the LIKE clause has no relation to the escaped single quotation mark (%,?)
If you want to be compatible with other databases, you should use PDO to manipulate the database. Pdo::quote is used for escaping (different database escape characters are not the same), and PDO::p Repare can do without explicit escaping
