php - need to call mysql_real_escape_string() twice -

i have user-input data put mysql database (version 5.5.8 according phpmyadmin) - find mysql_real_escape_string() in example below must called twice or no backslashes added user input text such "she's great boat isn't she"

the problem occurs when try write type of "text string containing quotes" database -- user input string written database no backslashes -- unless call mysql_real_escape_string() twice.

i use phpmyadmin view newly-written database record, , user's text-string-with-quotes has no escaping on quotes (no backslashes). if read text string out of database, quotes not escaped, ie. don't have call stripslashes() reverse use of mysql_real_escape_string().

the code below. when call get_magic_quotes_gpc() shows disabled.

my expectation this: if user inputs text string "she's great boat isn't she" -- , call mysql_real_escape_string() one time on user input text, , write database, one call mysql_real_escape_string() create text string looks this:

\"she\'s great boat isn\'t she\"

but text written database (see below) shows no escaping, original user-input text unescaped quotes.

this php code writes user text string database:

// theusersinputtext contains "she's great boat isn't she" $thetext = $_post['theusersinputtext'];  $thedb = connecttodb();    // reports magic quotes disabled if(get_magic_quotes_gpc()) echo "magic quotes enabled"; else echo "magic quotes disabled";    $theescapedtext =  mysql_real_escape_string($thetext); $newinsertquery = "insert " . "mydatabasetable"          . " values "         . "('" . $theescapedtext . "')"; 

when use phpmyadmin @ database, no slashes in text string. , when retrieve string database -- looks this: "she's great boat isn't she"

it makes me think i'm open injection attack then.

so modified code above adding second call mysql_real_escape_string, , when @ database, text string looks this:

\"she\'s great boat isn\'t she\"

here's modified code:

$thetext = $_post['theusersinputtext'];    // new line of code here $thestrangelyunescapedtext =  mysql_real_escape_string($thetext);      $thedb = connecttodb();    // reports magic quotes disabled if(get_magic_quotes_gpc()) showalertbox("magic quotes enabled"); else showalertbox("magic quotes disabled");     $thefinallyescapedtext =  mysql_real_escape_string($thestrangelyunescapedtext); $newinsertquery = "insert " . "mydatabasetable"          . " values "         . "('" . $thefinallyescapedtext . . "')"; 

after above, in phpmyadmin, when @ just-written database record, text looks like:

\"she\'s great boat isn\'t she\"

why have call mysql_real_escape_string() twice here?

written in way

$theescapedtext =  mysql_real_escape_string($thetext); $newinsertquery = "insert `mydatabasetable`  values ('$theescapedtext')"; 

i query output

insert `mydatabasetable` values ('\"she\'s great boat isn\'t she\"') 

the slashes make query syntactically correct , try avoid sql injection, in db query stored original text

"she's great boat isn't she" 

as side note: mysql_* extension deprecated of php 5.5.0, , removed in future. instead, mysqli or pdo_mysql extension should used.

a useful link why shouldn't use mysql_* functions in php