Click Upvote Click Upvote - 3 months ago 20
PHP Question

How to escape strings in SQL Server using PHP?

I'm looking for the alternative of

mysql_real_escape_string()
for SQL Server. Is
addslashes()
my best option or there is another alternative function that can be used?

Edit: Alternative for
mysql_error()
would also be useful.

Answer

addslashes() isn't fully adequate, but PHP's mssql package doesn't provide any decent alternative. The ugly but fully general solution is encoding the data as a hex bytestring, i.e.

$unpacked = unpack('H*hex', $data);
mssql_query('
    INSERT INTO sometable (somecolumn)
    VALUES (0x' . $unpacked['hex'] . ')
');

Abstracted, that would be:

function mssql_escape($data) {
    if(is_numeric($data))
        return $data;
    $unpacked = unpack('H*hex', $data);
    return '0x' . $unpacked['hex'];
}

mssql_query('
    INSERT INTO sometable (somecolumn)
    VALUES (' . mssql_escape($somevalue) . ')
');

mysql_error() equivalent is mssql_get_last_message().