note 108905 deleted from pdo.quote by aharvey

Note Submitter: nemozny at gmail dot com ---- While rewriting some application to PDO, remember that PDO->quote is adding the quotes around the whole value! Compared to mysql_real_escape_string which is quoting only the dangerous characters. <?php $value = "hello's world"; echo mysql_real_escape_string($value); // hello''s world echo $dbh->quote($value); // 'hello''s world' // This second quoting will break your old SQL statements which includes the quotes already. Workaround is to remove first and last character echo substr($dbh->quote($value), 1, -1); // hello''s world ?>