Table of Contents for

MySQL in a Nutshell, 2nd Edition

Use this method to escape special characters contained in a given string. It’s useful in SQL statements, particularly for unknown user input that might contain metacharacters that would cause undesirable behavior in MySQL. You can specify the data type as a second parameter. Don’t use this method with bind values and placeholders. Here is an example:

...
my $comment = shift;
my $quoted_comment = $dbh->quote($comment);

my $sql_stmnt = "UPDATE books SET comment = ?";
my $sth = $dbh->prepare($sql_stmnt);
$sth->execute($quoted_comment);

print "Original: $comment \n Quoted: $quoted_comment \n";

Here are the command line results:

Original: Henry James' book "The Muse" is wonderful! 
Quoted: 'Henry James\' book \"The Muse\" is wonderful!'