Why can't this approach prevent SQL injection?

First of all I do not know MySQL is not all types of data can be added single quotation marks, I just tried, in the whole number of integers plus single quotation marks as if there is no problem.
If it is true that any type of data can be enclosed in single quotes, add single quotes to any data when generating the MySQL statement, and then use mysql_escape_string to escape all special characters in the received character. This allows the received string to be completely "restricted" between single quotes.

But even if it seems like it can't be once and for all, because escaping in a string similar to the one after the like clause seems to be different from the normal string. In addition, if any of the updates in the amp involve escaping, there may be a problem. Are there any solutions to these two problems once and for all? Are there any other questions?

Reply to discussion (solution)

The escape in the string following the LIKE clause appears to be different from the normal string
How is it different?

Mysqli, PDO are provided with data binding
No manual escaping is required when using data binding

The escape in the string following the LIKE clause appears to be different from the normal string
How is it different?

Mysqli, PDO are provided with data binding
No manual escaping is required when using data binding
The backslash in like is \\\.

Don't look like, take out an example to

Don't look like, take out an example to
It seems to be related to PHP, not directly in the command line interview. is perfectly normal on the command line. In addition, three backslashes are also required in the phpMyAdmin.

Don't look like, take out an example to
It seems to be related to PHP, not directly in the command line interview. is perfectly normal on the command line. In addition, three backslashes are also required in the phpMyAdmin.
I just made a slash in the backslash, and then I can try it out in the command line.

mysql> use testdatabase changedmysql> CREATE TABLE backlash (id int, value char (20)); Query OK, 0 rows Affected (0.00 sec) mysql> INSERT into backlash (ID, Value) VALUES (1, ' \ \ '); Query OK, 1 row Affected (0.00 sec) mysql> SELECT * from backlash where value= ' \ \ '; +------+-------+| ID   | value |+------+-------+|    1 | \     |+------+-------+1 row in Set (0.00 sec) mysql> SELECT * from backlash where value like '%\\% '; Empty Set (0.00 sec) mysql> SELECT * from backlash where value like '%\\\% '; +------+-------+| ID   | value |+------+-------+|    1 | \     |+------+-------+1 row in Set (0.00 sec) mysql>

Don't look like, take out an example to
Use PHP to add six backslashes:

 
  '; $result =mysql_query ($sql, $conn); $row =mysql_fetch_row ($result); Echo $row [0];echo '
';? >

I did it just by getting the backslash through get, so just three straight. Confused.

