pg_escape_string not working

Question

I want to use pg_escape_string in my password can anyone sugest me hows it is used? in my postgresql insert table

$query = "insert into vmobjects (guid,ipaddress,username,password,hostid,vmname,guestostype) values('".$guid."','".$ip."','".$username."','".$password."','".$hostid."','".$name."','".strtolower($os)."')";

I m using $escaped = pg_escape_string($password);

$query = "insert into vmobjects (guid,ipaddress,username,password,hostid,vmname,guestostype) values('".$guid."','".$ip."','".$username."','".$escaped ."','".$hostid."','".$name."','".strtolower($os)."')";

but it is not working it wil not take my & and + string ... like if i insert @#&$%&^* as a password then after @# it shows nul values .... pg_escape_string not working

It wil takes '~!@#$%^*()_=-{}|][:"';<>?/.,'except& and +` string.

my backend table row insert & string as a null value and after & string all values are null and In the case of + string this is only null

Plz Don't refer me the sites manual

Ya I'm POSTing the contents of a form field via AJAX to a PHP script and using this code

if(!http)
            http = CreateObject();  

        nocache = Math.random();

        http.open('post', 'addvm.php');
        http.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); 
        http.setRequestHeader("Content-length", params.length);
        http.setRequestHeader("Connection", "close");
        http.onreadystatechange = SaveReply;

        http.send(params);

Answer 1

Forget about pg_escape_string and similar "workarounds".

What you want are prepared statements and bind parameters or (in case you're unwilling to jump right in) at least pg_query_params.

Answer 2

Just use pg_query_params() to make things very simple:

$query = "
INSERT INTO vmobjects 
  (guid,ipaddress,username,password,hostid,vmname,guestostype) 
VALUES($1, $2, $3, $4, $5, $6, $7)"; // $1 to $7 are the placeholders
$result = pg_query_params(
  $connection, // your database connection should be here
  $query,      // the query itself, including placeholders
  array($guid,$ip,$username,$password,$hostid,$name,strtolower($os) // array with values
);

There is no need for pg_escape_string when using pg_query_params. pg_query_params is by far the most simple aproach for interaction with your database.