Securing Strings with the quote() Method

The quote() method adds quotes around an input string (if required) and escapes special characters within that string, making the result safe to use inside a direct SQL query. Although modern programming strongly recommends using prepared statements with prepare(), the quote() method remains useful for quick queries where you want to manually ensure that the input data won't break the SQL command or permit an attack.

EXAMPLE

<?php
class Database {
    private $server = "localhost";
    private $username = "root";
    private $password = "";
    private $db_name = "pdo_db";
    public $connection;

    public function __construct() {
        try {
            // Added charset=utf8mb4 for character support
            $dsn = "mysql:host=" . $this->server . ";dbname=" . $this->db_name . ";charset=utf8mb4";
            $this->connection = new PDO($dsn, $this->username, $this->password);
            $this->connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        } catch(PDOException $e) {
            die("Connection failed: " . $e->getMessage());
        }
    }

    public function safeQuote($text) {
        // The method returns a secured string wrapped in quotes
        return $this->connection->quote($text);
    }
}

// PART 3: Usage
$db = new Database();
$input = "O'Reilly"; // String with a special character
$secured = $db->safeQuote($input);

echo "Original input: " . $input . "<br>";
echo "Secured string for SQL: " . $secured;
?>

RESULT

The result will be displayed here...

Practical Application: The method returns a secured string, which you then embed directly into your SQL code. Check the process at home by following these steps:

Start the Apache and MySQL modules in the XAMPP control panel.
You call the quote method directly on the connection object ($this->connection).
Observe how the method automatically wraps the text in single quotes (e.g., 'text').
Insert the example below into a PHP file and see the difference between a raw input and a secured string.