Im using smarty and mysql_real_escape_string() for user input,
and when I insert some code with ' or " , and lookup in phpmyadmin
it shows without backslashes.
When I get record from DB i doesn't have backslashes also. But when I just pass escaped string without inserting into the db it is backslashed.
Shouldn't it add slashes, insert with them and then I would strip them when i would output? Or am I missing something?
You're missing it - escaping with backslashes is meant to ensure that queries aren't malformed, e.g. something like this will surely break and possibly risk SQL injections:
insert into table values ('whatever 'this' is')
and nothing will be saved in the table, whereas this:
insert into table values ('whatever \'this\' is')
will save the value "whatever 'this' is" in the table.
来源：https://stackoverflow.com/questions/277575/shouldnt-mysql-real-escape-string-leave-slashes-in-database