Question: What is the equivalent javascript code for `mysql_real_escape_string()`?

Answer: 
Based on the [PHP documentation](http://php.net/manual/en/function.mysql-real-escape-string.php) of the method this would do roughly the same thing. The method mysql\_real\_escape\_string in PHP is deprecated however.

```
function mysqlEscape(stringToEscape){
    return stringToEscape
        .replace("\\", "\\\\")
        .replace("\'", "\\\'")
        .replace("\"", "\\\"")
        .replace("\n", "\\\n")
        .replace("\r", "\\\r")
        .replace("\x00", "\\\x00")
        .replace("\x1a", "\\\x1a");
}

```

Unfortunately that's not exactly what mysql\_real\_escape\_string does according to the [5.6 mysql API docs](http://dev.mysql.com/doc/refman/5.6/en/mysql-real-escape-string.html). It doesn't take into account character encodings among other things.

The above method will likely do what you're looking for even if you only use the first 2 replaces like so.

```
function mysqlEscape(stringToEscape){
    return stringToEscape
        .replace("\\", "\\\\")
        .replace("\'", "\\\'");
}

```

According to the mysql docs.

> 
> MySQL requires only that backslash and the quote character used to quote the string in the query be escaped. mysql\_real\_escape\_string() quotes the other characters to make them easier to read in log files
> 
> 
>
There isn't any, because strings that come from JavaScript are still considered 'user input' and **should never be inserted in your database directly**. Your server-side has to do additional validation. There are functions to encode URLs and stuff like that. 

What are you trying to do?