|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #54437 mysql_real_escape_string don't escape: \x00, \n, \r and \x1a
Submitted: 2011-03-31 22:54 UTC Modified: 2011-04-01 18:31 UTC
From: jose dot nobile at gmail dot com Assigned:
Status: Not a bug Package: MySQL related
PHP Version: 5.3.6 OS: Any
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: jose dot nobile at gmail dot com
New email:
PHP Version: OS:


 [2011-03-31 22:54 UTC] jose dot nobile at gmail dot com
mysql_real_escape_string don't escape: \x00, \n, \r and \x1a as is mentioned in 

and \r in a quote string in a insert into query, is a syntax error, I'm handling 
binary data (PDF Files).

Tested on Windows XP SP3 with PHP builds from PHP, and Centos 5.5 with personal 
configure, both using PHP 5.3.6 and in Windows, MySQL Server version is 5.5.8-log 
and Centos is 5.0.77-log

Client API version	mysqlnd 5.0.8-dev - 20102224 - $Revision: 308673 $

Test script:
$link = @mysql_pconnect("localhost","root","");
if (!$link)
	die('Not connected : ' . mysql_error());
echo "\\x00, \\n, \\r, \\, ', \" and \\x1a.";
echo "<br />\r\n";
print mysql_escape_string("\x00, \n, \r, \, ', \" and \x1a.");

Expected result:
\x00, \n, \r, \, ', " and \x1a.

\\x00, \\n, \\r, \\, \', \" and \\x1a.

Actual result:
\x00, \n, \r, \, ', " and \x1a.

\0, \n, \r, \\, \', \" and \Z.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2011-04-01 07:52 UTC]
-Status: Open +Status: Bogus
 [2011-04-01 07:52 UTC]
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at and the instructions on how to report
a bug at

 [2011-04-01 15:36 UTC] jose dot nobile at gmail dot com
Can you explain, why this function is not working as is documented?

And, What is the correct function, to espace binary data with chars "\r" than to 
have to escape before to send to mysql?
 [2011-04-01 18:31 UTC]
Those are control characters. Because they've been escaped you're seeing a text 
representation of them instead of 
the literal characters. I don't know why you would expect anything different 
from when you manually escaped them? 

You can escape binary data with with mysql_real_escape_string or change the 
encoding your binary data to base64 for 

PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Tue Mar 28 06:03:37 2023 UTC