New function mysqli_quote_string

The RFC passed 15 to 2, with 4 abstaining, clearing the two-thirds majority it needed. Voting closed on March 8, 2026. It targeted PHP 8.6, and the change has been merged into php-src.

If you escape strings by hand with mysqli, you call real_escape_string() and then add the quotes around the value yourself. Forget them, or pick the wrong kind, and you've opened an SQL injection hole. This RFC from Kamil Tekiela adds mysqli::quote_string(), which escapes the string and wraps it in single quotes for you, the same way PDO::quote() does.

How it works#

public function quote_string(string $string): string {}
// AND
function mysqli_quote_string(mysqli $mysql, string $string): string {}

"'Don\\'t!'" === $link->quote_string("Don't!");

Before, you'd write something like this:

$sql = sprintf("SELECT '%s'", $mysqli->real_escape_string($value));

Now you drop the quotes from the query:

$sql = sprintf('SELECT id FROM foo WHERE name=%s', $mysqli->quote_string($value));

The hole it fixes#

real_escape_string() isn't safe inside double quotes when MySQL's NO_BACKSLASH_ESCAPES mode is enabled. The RFC shows a value like " OR 1=1 -- foo slipping past it and matching every row, while the same query with quote_string() matches nothing.

The new function always uses single quotes. You can't choose the quote character, so you can't choose the wrong one, and the RFC notes that double-quoted strings aren't standard SQL anyway.

Prepared statements are still the best defense against SQL injection. This function is for projects that need to build full queries by hand, like phpMyAdmin. The name ends in string on purpose, to make clear it's only for string values.

What it means for existing code#

Nothing breaks, and real_escape_string() stays. The author hopes to deprecate it in a later version, but that isn't part of this RFC. If you switch, remember to remove the quotes you added by hand. Libraries that expose real_escape_string() to their users may have more work to do.