# Handling Special Characters In SQL Statements
+ For example: **`'`**
  + **`INSERT INTO test.mdk (title) values ('Mother's day kisses')`** 
+ Solutions
  + Solution A: Use a backslash **`(\)`**  character to escape
  + Solution B: Use backward quote
  + Solution C: Use **`mysqli::real_escape_string`**
  + Solution D (recommended): Use placeholders and prepared statement
------------------------------------------------------------

Some special characters in SQL statements, such as quotation marks or backslashes, cause problems. In the example in the slide, the name `Mother's`, which contains a single quotation mark as part of the name, makes the statement syntax invalid. You must use one of the character escaping methods. This is easy to do when you are coding the SQL yourself and know all possible values in advance, but can be a problem when you are creating applications where users enter values at run time or if your data is coming from other sources. 

Using `mysqli::real_escape_string` example:
```
...
    $content = "Mother's day kisses";
    $query = sprintf("INSERT INTO mdk (content)"
      . " VALUES "
      . "('%s')", $mysqli->real_escape_string($content));
    $num = $mysqli->query($query);
...
```

The best solution to this problem is Solution D, to use placeholders. For PHP programs, use prepared statements to achieve this.

In course 201.3, we discussed the prepared statement. We will learn it again in the next unit.