What characters have to be escaped to prevent (My)SQL injections?

I'm using MySQL API's function ``` mysql_real_escape_string() ``` Based on the documentation, it escapes the following characters: ``` \0 \n \r \ ' " \Z ``` Now, I looked into OWASP.org's ESAPI security library and in the Python port it had the following code (http://code.google.com/p/owasp-esapi-python/source/browse/esapi/codecs/mysql.py): ``` """ Encodes a character for MySQL. """ lookup = { 0x00 : "\\0", 0x08 : "\\b", 0x09 : "\\t", 0x0a : "\\n", 0x0d : "\\r", 0x1a : "\\Z", 0x22 : '\\"', 0x25 : "\\%", 0x27 : "\\'", 0x5c : "\\\\", 0x5f : "\\_", } ``` Now, I'm wondering whether all those characters are really needed to be escaped. I understand why % and _ are there, they are meta characters in LIKE operator, but I can't simply understand why did they add backspace and tabulator characters (\b \t)? Is there a security issue if you do a query: ``` SELECT a FROM b WHERE c = '...user input ...'; ``` Where user input contains tabulators or backspace characters? My question is here: Why did they include \b \t in the ESAPI security library? Are there any situations where you might need to escape those characters?