mysql_real_escape_string alternative for SQL Server [duplicate]

Answer 1

The short answer is: use whatever mechanism your connection libraries provide, it really has nothing to do with the database. If you're using ADO, you have parameterized queries, if you're using something else (I know nothing about PHP) then use whatever that library offers.

Rolling your own is probably a bad idea, because you're very likely to get something wrong, e.g. handling comment delimiters correctly.

Answer 2

Nice question, I don't know but you could use PDO::quote() with the PDO_DBLIB driver.

---

EDIT: Seems like this guy got it from StackOverflow:

function mssql_escape($data) {
    if(is_numeric($data))
        return $data;
    $unpacked = unpack('H*hex', $data);
    return '0x' . $unpacked['hex'];
}

---

Another option:

function mssql_escape($str)
{
    if(get_magic_quotes_gpc())
    {
        $str= stripslashes($str);
    }
    return str_replace("'", "''", $str);
}

Answer 3

The best alternative is to use parameterised queries, then you don't have to escape strings.

If you still want to put the query together yourself, the proper way to escape a string literal for SQL Server (T-SQL) is to replace each apostrophe (') in the string with two apostrophes.