Re: Escape sproc Parameters

[John Noble]

Peter Brawley Wrote:
-------------------------------------------------------
> Right, actually input data needs to be cleaned up
> before it gets to MySQL, you need to pass your
> strings through your language's equivalent of
> PHP's mysqli_real_escape_string().


Hi Peter,

That's not the behavior I am seeing.

In my c# WinFOrms application, I can write [John's boat] into the textbox and QUOTE(p_name) will insert it nicely.

From W3Resource...
MySQL QUOTE() produces a string which is a properly escaped data value in an SQL statement, out of a user supplied by the string as an argument.