apostrophe during Insert (Mysql)

Question

I am getting data though a PHP text box and inserting it into a MySQL database with a normal insert command. The text box takes in a comment frm the user for a particular Accession ID next to the text box. The problem is that when a user types in apostrophe (') for example the sentence "We have to take care of the PC's", an error is thrown.

I know why its happening because the SQL assumes it as the end of the string for that value but I don't know how to escape it. I would prefer escaping it in MYSQL.

If I escape it in MySQL can it still be exploited as SQL injection even if no error is generated and the insert works fine?

Answer 1

Use mysql_real_escape_string(), or better yet, use parameterised queries with PDO.

Answer 2

use the function mysql_real_escape_string()