mysql_real_escape_string alternative for SQL Server

Question

Am wondering what is the equivalent in PHP for SQL Server escaping of strings?

Solution 1

Nice question, I don't know but you could use PDO::quote() with the PDO_DBLIB driver.

---

EDIT: Seems like this guy got it from StackOverflow:

function mssql_escape($data) {
    if(is_numeric($data))
        return $data;
    $unpacked = unpack('H*hex', $data);
    return '0x' . $unpacked['hex'];
}

---

Another option:

function mssql_escape($str)
{
    if(get_magic_quotes_gpc())
    {
        $str= stripslashes($str);
    }
    return str_replace("'", "''", $str);
}

Solution 2

The best alternative is to use parameterised queries, then you don't have to escape strings.

If you still want to put the query together yourself, the proper way to escape a string literal for SQL Server (T-SQL) is to replace each apostrophe (') in the string with two apostrophes.