note 125972 added to mysqli.real-escape-string

Caution when escaping the % and _ wildcard characters. According to an often overlooked note at the bottom of: https://dev.mysql.com/doc/refman/5.7/en/string-literals.html#character-escape-sequences the escape sequences \% and \_ will ONLY be interpreted as % and _, *if* they occur in a LIKE! (Same for MySQL 8.0) In regular string literals, the escape sequences \% and \_ are treated as those two character pairs. So if those escape sequences appear in a WHERE "=" instead of a WHERE LIKE, they would NOT match a single % or _ character! Consequently, one MUST use two "escape" functions: The real-escape-string (or equivalent) for regular string literals, and an amended escape function JUST for string literals that are intended to be used in LIKE. ---- Server IP: 45.112.84.4 Probable Submitter: 45.112.85.242 (proxied: 206.128.157.247) ---- Manual Page -- http://php.net/manual/en/mysqli.real-escape-string.php Edit -- https://master.php.net/note/edit/125972 Del: integrated -- https://master.php.net/note/delete/125972/integrated Del: useless -- https://master.php.net/note/delete/125972/useless Del: bad code -- https://master.php.net/note/delete/125972/bad+code Del: spam -- https://master.php.net/note/delete/125972/spam Del: non-english -- https://master.php.net/note/delete/125972/non-english Del: in docs -- https://master.php.net/note/delete/125972/in+docs Del: other reasons-- https://master.php.net/note/delete/125972 Reject -- https://master.php.net/note/reject/125972 Search -- https://master.php.net/manage/user-notes.php