pg_escape_string

(PHP 4 >= 4.2.0, PHP 5, PHP 7)

pg_escape_string — Escape a string for query

Description

string pg_escape_string ([ resource $connection ], string $data )

pg_escape_string() escapes a string for querying the database. It returns an escaped string in the PostgreSQL format without quotes. pg_escape_literal() is more preferred way to escape SQL parameters for PostgreSQL. addslashes() must not be used with PostgreSQL. If the type of the column is bytea, pg_escape_bytea() must be used instead. pg_escape_identifier() must be used to escape identifiers (e.g. table names, field names)

Note:
This function requires PostgreSQL 7.2 or later.

Parameters

connection: PostgreSQL database connection resource. When connection is not present, the default connection is used. The default connection is the last connection made by pg_connect() or pg_pconnect().
data: A string containing text to be escaped.

Return Values

A string containing the escaped data.

Changelog

Version	Description
5.2.0	`connection` added

Examples

Example #1 pg_escape_string() example


<?php 
  // Connect to the database
  $dbconn = pg_connect('dbname=foo');
  
  // Read in a text file (containing apostrophes and backslashes)
  $data = file_get_contents('letter.txt');
  
  // Escape the text data
  $escaped = pg_escape_string($data);
  
  // Insert it into the database
  pg_query("INSERT INTO correspondence (name, data) VALUES ('My letter', '{$escaped}')");
?>

User Contributed Notes

strata_ranger at hotmail dot com

5 years ago


Forthose curious, the exact escaping performed on the string may vary slightly depending on your database configuration.

For example, if your database's standard_conforming_strings variable is OFF, backslashes are treated as a special character and pg_escape_string() will ensure they are properly escaped.  If this variable is ON, backslashes will be treated as ordinary characters, and pg_escape_string() will leave them as-is.  In either case, the behavior matches the configuration of the database connection.

Nathan Bruer

8 years ago


If your database is a UTF-8 database, you will run into problems trying to add some data into your database...



for securty issues and/or compatability you may need to use the: utf_encode() (http://php.net/utf8-encode) function.



for example:

<?php

$my_data = pg_escape_string(utf8_encode($_POST['my_data']));

?>

ringerc at ringerc dot id dot au

2 years ago


You should prefer to use pg_query_params, i.e. use parameterized queries, rather than using pg_escape_string. Or use the newer PDO interface with its parameterized query support.

If you must substitute values directly, e.g. in DDL commands that don't support execution as parameterized queries, do so with pg_escape_literal:

http://au1.php.net/manual/en/function.pg-escape-literal.php

Identifiers can't be used as query parameters. Always use pg_escape_identifier for these if they're substituted dynamically:

http://au1.php.net/manual/en/function.pg-escape-identifier.php

You should not need to change text encodings when using this function. Make sure your connection's client_encoding is set to the text encoding used by PHP, and the PostgreSQL client driver will take care of text encodings for you. No explicit utf-8 conversions should be necessary with a correctly set  client_encoding.

ppp

4 years ago


pg_escape_string() won't cast array arguments to the "Array" string like php usually does; it returns NULL instead. The following statements all evaluate to true:

<?php
$a = array('foo', 'bar');

"$a" == 'Array';
(string)$a == 'Array';
$a . '' == 'Array';

is_null(pg_escape_string($a));
?>

meng

9 years ago


Since php 5.1 the new function pg_query_params() was introduced. With this function you can use bind variables and don't have to escape strings. If you can use it, do so. If unsure why, check the changelog for Postgres 8.0.8.

Gautam Khanna