Prior to doing an INSERT, do you MySQL real escape data before JSON encoding it, or after JSON encoding? [duplicate]

Question

This question already has answers here:

How can I prevent SQL injection in PHP? (28 answers)

Closed last year.

Before inserting JSON-encoded data in MySQL, do you first JSON encode the data and then escape it prior to inserting, or do you first escape the data before JSON encoding it and then insert it?

Answer 1

First JSON encode it then escape it prior to inserting in the database.

Answer 2

Don't use mysql_real_escape_string - it's deprecated. http://php.net/manual/en/function.mysql-real-escape-string.php If you use one of the DB libraries such as PDO, then that will do the work for you. See real escape string and PDO

Answer 3

The very statement of question is wrong.

1. Do not store JSON in database.
2. real escape doesn't make your data safe, as it's implied in your question.
3. mysql-real-escape-string belongs to mysql - so, the answer is quite obvious.