|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #54437 mysql_real_escape_string don't escape: \x00, \n, \r and \x1a
Submitted: 2011-03-31 22:54 UTC Modified: 2011-04-01 18:31 UTC
From: jose dot nobile at gmail dot com Assigned:
Status: Not a bug Package: MySQL related
PHP Version: 5.3.6 OS: Any
Private report: No CVE-ID: None
 [2011-03-31 22:54 UTC] jose dot nobile at gmail dot com
mysql_real_escape_string don't escape: \x00, \n, \r and \x1a as is mentioned in 

and \r in a quote string in a insert into query, is a syntax error, I'm handling 
binary data (PDF Files).

Tested on Windows XP SP3 with PHP builds from PHP, and Centos 5.5 with personal 
configure, both using PHP 5.3.6 and in Windows, MySQL Server version is 5.5.8-log 
and Centos is 5.0.77-log

Client API version	mysqlnd 5.0.8-dev - 20102224 - $Revision: 308673 $

Test script:
$link = @mysql_pconnect("localhost","root","");
if (!$link)
	die('Not connected : ' . mysql_error());
echo "\\x00, \\n, \\r, \\, ', \" and \\x1a.";
echo "<br />\r\n";
print mysql_escape_string("\x00, \n, \r, \, ', \" and \x1a.");

Expected result:
\x00, \n, \r, \, ', " and \x1a.

\\x00, \\n, \\r, \\, \', \" and \\x1a.

Actual result:
\x00, \n, \r, \, ', " and \x1a.

\0, \n, \r, \\, \', \" and \Z.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2011-04-01 07:52 UTC]
-Status: Open +Status: Bogus
 [2011-04-01 07:52 UTC]
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at and the instructions on how to report
a bug at

 [2011-04-01 15:36 UTC] jose dot nobile at gmail dot com
Can you explain, why this function is not working as is documented?

And, What is the correct function, to espace binary data with chars "\r" than to 
have to escape before to send to mysql?
 [2011-04-01 18:31 UTC]
Those are control characters. Because they've been escaped you're seeing a text 
representation of them instead of 
the literal characters. I don't know why you would expect anything different 
from when you manually escaped them? 

You can escape binary data with with mysql_real_escape_string or change the 
encoding your binary data to base64 for 

PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Jun 23 19:01:32 2024 UTC