quoteString() versus mysql_escape_string()

The PEAR DB quoteString() method doesn't appear to quote anything other than single quotes. This seems incorrect to me, at least for MySQL. Test program: <?php # Compare $conn->quoteString() with mysql_escape_string() require_once ("DB.php"); $dsn = "mysql://testuser:testpass@localhost/test"; $conn = @DB::connect ($dsn); if (DB::isError ($conn))

    die ("Cannot connect: " . $conn->getMessage () . "\n");

$str_array = array (

    "abc",
    "a'c",
    "a\"c",
    "a\\c",
    "a\0c"

); foreach ($str_array as $str) {

    printf ("string = (%s)\n", $str);
    printf ("\tquoteString = (%s)\n", $conn->quoteString ($str));
    printf ("\tmysql_escape_string = (%s)\n", mysql_escape_string ($str));

} $conn->disconnect (); ?> Program output: string = (abc)

    quoteString = (abc)
    mysql_escape_string = (abc)

string = (a'c)

    quoteString = (a\'c)
    mysql_escape_string = (a\'c)

string = (a"c)

    quoteString = (a"c)
    mysql_escape_string = (a\"c)

string = (a\c)

    quoteString = (a\c)
    mysql_escape_string = (a\\c)

string = (a)

    quoteString = (a)
    mysql_escape_string = (a\0c)

In the last case, the string and quoteString lines actually contain a NUL byte that doesn't print, so inserting the string into MySQL does get the correct value into the database. However, the fourth case (for the backslash) results in the backslash being lost. The same thing happens if you attempt to bind a value to a placeholder when the value contains backslashes. Maybe I'm just getting mixed up over the levels of quoting, but I don't think so given the results of the other cases. Perhaps the default quoteString() method should be overridden for MySQL with a method that invokes mysql_escape_string(). -- Paul DuBois, paul@snake.net