Alternative to mysql_real_escape_string without connecting to DB
mysql, mysql-real-escape-string, php
Solution
It is impossible to safely escape a string without a DB connection. `mysql_real_escape_string()` and prepared statements need a connection to the database so that they can escape the string using the appropriate character set - otherwise SQL injection attacks are still possible using multi-byte characters.
If you are only testing, then you may as well use `mysql_escape_string()`, it's not 100% guaranteed against SQL injection attacks, but it's impossible to build anything safer without a DB connection.
Problem
I'd like to have a function behaving as mysql_real_escape_string without connecting to database as at times I need to do dry testing without DB connection. mysql_escape_string is deprecated and therefore is undesirable. Some of my findings: http://www.gamedev.net/community/forums/topic.asp?topic_id=448909 http://w3schools.invisionzone.com/index.php?showtopic=20064