What characters have to be escaped to prevent (My)SQL injections?

Question

I\'m using MySQL API\'s function

mysql_real_escape_string()

Based on the documentation, it escapes the following characters:

Answer 1

The MySQL manual page for strings says:

• \0   An ASCII NUL (0x00) character.
• \'   A single quote (“'”) character.
• \"   A double quote (“"”) character.
• \b   A backspace character.
• \n   A newline (linefeed) character.
• \r   A carriage return character.
• \t   A tab character.
• \Z   ASCII 26 (Control-Z). See note following the table.
• \\   A backslash (“\”) character.
• \%   A “%” character. See note following the table.
• \_   A “_” character. See note following the table.