note 108905 added to pdo.quote

While rewriting some application to PDO, remember that PDO->quote is adding the quotes around the whole value! Compared to mysql_real_escape_string which is quoting only the dangerous characters. <?php $value = "hello's world"; echo mysql_real_escape_string($value); // hello''s world echo $dbh->quote($value); // 'hello''s world' // This second quoting will break your old SQL statements which includes the quotes already. Workaround is to remove first and last character echo substr($dbh->quote($value), 1, -1); // hello''s world ?> ---- Server IP: 147.32.160.17 Probable Submitter: 94.112.81.31 ---- Manual Page -- http://www.php.net/manual/en/pdo.quote.php Edit -- https://master.php.net/note/edit/108905 Del: integrated -- https://master.php.net/note/delete/108905/integrated Del: useless -- https://master.php.net/note/delete/108905/useless Del: bad code -- https://master.php.net/note/delete/108905/bad+code Del: spam -- https://master.php.net/note/delete/108905/spam Del: non-english -- https://master.php.net/note/delete/108905/non-english Del: in docs -- https://master.php.net/note/delete/108905/in+docs Del: other reasons-- https://master.php.net/note/delete/108905 Reject -- https://master.php.net/note/reject/108905 Search -- https://master.php.net/manage/user-notes.php