I have to show an example is it will explain better then I can with words alone.

I want to mysql_real_escape_string my data before I make a query.
Here is a sample:

PHP Code:

$where = "article_name = 'some_article_name'"; 


Here is what I currently have that will real escape anything between the single quotes :

PHP Code:

$where = preg_replace("/(')(.*)(')/eis", "'$1' . mysql_real_escape_string('$2') . '$3'", $where); 


Works great. but if my original $where is:

PHP Code:

$where = "article_name = 'some_article_name' AND article_title = 'something'"; 


Now the preg_replace takes the first single quote and the last single quote and escapes in between. leaving me with:

PHP Code:

article_name = 'some_article_name\' AND article_title = \'something' 


see how it escapes the single quotes in between the first and last.

I would like it to only escape between each SET of single quotes.
Anyone have any advice?

I think that you should not escape queries with the help of preg_replace. Not only do you have to detect when you have multiple conditions in your where statement, but you have to worry about quotes inside each value. Let's say your $where var is something like this:

PHP Code:

$where = "article = '$value'"; 


If $value somehow manages to be something like ' OR '1'='1, (see SQL injection) then your $where variable will contain this:

PHP Code:

"article = '' OR '1'='1'" 


I don't think there's anyway you can properly sanitize that with the method you are currently using, nor with the method you want to use.

I think a much safer way is to use mysql_real_escape_string individually on every single variable you put in a query.

PHP Code:

$where = "article = '".mysql_real_escape_string($value)."'"; 


This prevents sql errors and sql injection, and even though it may make your PHP code around queries look longer (and possibly more complex) it's a very good habit to follow imho.

I think frost is correct, but in case it's helpful otherwise - I think the problem with your regular expression is that it's too "greedy" - try this:

$where = preg_replace("/(')(.*?)(')/eis", "'$1' . mysql_real_escape_string('$2') . '$3'", $where); 

The key is the "?" in pattern that tells it not to be so greedy