# MySQL string escaping

**URL:** <https://forum.getkirby.com/t/mysql-string-escaping/4628>\
**Category:** Questions\
**Tags:** v2\
**Created:** [July 6, 2016, 11:46pm UTC](https://forum.getkirby.com/t/mysql-string-escaping/4628 "2016-07-06T23:46:19Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tnViking](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/tnviking/32/4407_2.png) [@tnViking](https://forum.getkirby.com/u/tnViking)\
**Post date:** [July 6, 2016, 11:46pm UTC](https://forum.getkirby.com/t/mysql-string-escaping/4628/1 "2016-07-06T23:46:19Z")

</div>

Are queries being “escaped” natively in Kirby toolkit, or what do I need to do to prevent MySQL injection?

---

<div class="post-metadata">

**Author:** ![tnViking](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/tnviking/32/4407_2.png) [@tnViking](https://forum.getkirby.com/u/tnViking)\
**Post date:** [July 6, 2016, 11:49pm UTC](https://forum.getkirby.com/t/mysql-string-escaping/4628/2 "2016-07-06T23:49:25Z")

</div>

I found an escape function in the docs, so to secure a query I just have to add **-\>escape()** to the end of it? (roughly)

```auto
$bookings->insert(array(
    "user" => getUserID($_POST["email"]),
    "start_time" => $_POST["start-time"],
    "end_time" => $_POST["end-time"],
    "date" => $_POST["date"],
    "adults" => $_POST["adults"],
    "children" => $_POST["children"],
    "under5" => $_POST["under5"],
    "bookingRef" => $bookingRef,
    "paid" => $totalPrice,
    "VAT" => $VAT,
    "processed" => time()
))->escape();

```

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [July 7, 2016, 7:12am UTC](https://forum.getkirby.com/t/mysql-string-escaping/4628/3 "2016-07-07T07:12:07Z")

</div>

`escape()` can only be used on a string, so that is on each user input separately. Additionally, you should validate your user input to make sure you get the right types and formats.

---

<div class="post-metadata">

**Author:** ![lukasbestle](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/lukasbestle/32/11437_2.png) [@lukasbestle](https://forum.getkirby.com/u/lukasbestle)\
**Post date:** [July 7, 2016, 9:31am UTC](https://forum.getkirby.com/t/mysql-string-escaping/4628/4 "2016-07-07T09:31:53Z")

</div>

Since Kirby 2.3, the Kirby database classes use query bindings for every value, so you don’t need to escape anything beforehand (actually that would break your code).

Only make sure that you pass structured data where possible (like in your example with the array). You can also pass a string to some methods (like `where()`), but then you need to do escaping beforehand.  
You can check if everything is escaped by using the `->debug()` method and then printing the result of the query. The SQL query should then include bindings for every value.

Please note that we can’t guarantee for proper SQL injection protection. You are responsible for the security of your code. 🙂

---

<div class="post-metadata">

**Author:** ![tnViking](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/tnviking/32/4407_2.png) [@tnViking](https://forum.getkirby.com/u/tnViking)\
**Post date:** [July 7, 2016, 6:50pm UTC](https://forum.getkirby.com/t/mysql-string-escaping/4628/5 "2016-07-07T18:50:24Z")

</div>

Ok, great. So I don’t have to use that mysql real escape function thingy’

---

<div class="post-metadata">

**Author:** ![lukasbestle](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/lukasbestle/32/11437_2.png) [@lukasbestle](https://forum.getkirby.com/u/lukasbestle)\
**Post date:** [July 7, 2016, 6:59pm UTC](https://forum.getkirby.com/t/mysql-string-escaping/4628/6 "2016-07-07T18:59:11Z")

</div>

In most cases not. 🙂

---

<div class="post-metadata">

**Author:** ![distantnative](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/distantnative/32/11319_2.png) [@distantnative](https://forum.getkirby.com/u/distantnative)\
**Post date:** [February 6, 2025, 4:57pm UTC](https://forum.getkirby.com/t/mysql-string-escaping/4628/7 "2025-02-06T16:57:37Z")

</div>