I'm using a rich text editor (Nicedit) with a cms project I'm making. In order to reduce the likelihood of SQL injections, I'm using the mysqli_real_escape_string function to escape the user input before putting it into the database.
However, I observed that all the single quotes will get an additional backslash attached to it when I echo it onto a page. For example, if the user input is "Let's have a meeting", it will become "Let\'s have a meeting".
I understand that the whole idea of escaping a string is to add a backslash to potentially problematic input. I'm just wondering if it's safe to remove the backslash in a string when echoing it back to the page?
$escaped_string = mysqli_real_escape_string($connection, $_POST['string']); echo str_replace("\\", "", $escaped_string);
Thank you! This project is just part of my learning PHP and won't be used anywhere, so please don't get worked up!