PHP : mysql_real_escape_string() function

The mysql_real_escape_string() function escapes special characters in a string for use in an SQL statement

The following characters are affected

Syntax : mysql_real_escape_string(string,connection)

string : Required. Specifies the string to be escaped

connection  : Optional. Specifies the MySQL connection. If not specified, the last connection opened by mysql_connect() or mysql_pconnect() is used.

Example :

<?php

// Connect$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')    OR die(mysql_error());
// Query$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",

            mysql_real_escape_string($user),      
           mysql_real_escape_string($password));
?>