What characters have to be escaped to prevent (My)SQL injections?
问题 I'm using MySQL API's function mysql_real_escape_string() Based on the documentation, it escapes the following characters: \0 \n \r \ ' " \Z Now, I looked into OWASP.org's ESAPI security library and in the Python port it had the following code (http://code.google.com/p/owasp-esapi-python/source/browse/esapi/codecs/mysql.py): """ Encodes a character for MySQL. """ lookup = { 0x00 : "\\0", 0x08 : "\\b", 0x09 : "\\t", 0x0a : "\\n", 0x0d : "\\r", 0x1a : "\\Z", 0x22 : '\\"', 0x25 : "\\%", 0x27 : "