CiviCRM Community Forums (archive)

I need to use the PHP function mysql_real_escape_string() in one of my custom searches, to escape the apostrophes in the SQL statement.

According to documentation I have found, I need to call "mysql_connect()" before calling the function mysql_real_escape_string(). 

Is there a simple way to use these functions in my custom search, so that it uses the CiviCRM database connection information?  Or os there another approach that is simpler?

My custom search is inserting data into a temp table, which then gets queried for the final results to show on the screen.  I am using the mysql_real_escape_string to make sure the data is safe to insert.

I already am using the function "CRM_Core_DAO::executeQuery" to execute the insert statement.   The issue I face is if I do not escape my SQL string before calling executeQuery, then I get a hard error when there is a special char in the data being inserted.

My call is currently:

CRM_Core_DAO::executeQuery( $sql,
                                       CRM_Core_DAO::$_nullArray );