According to php.net I should use [mysql\_real\_escape\_string()](http://php.net/manual/en/function.mysql-real-escape-string.php) and turn off [magic quotes](http://www.php.net/manual/en/security.magicquotes.whynot.php), because it's deprecated.

So I turned it off and I used mysql\_real\_escape\_string(), but is it enough to use it just like in the following code?

```
$value = "It's Time!";
$escaped_value = mysql_real_escape_string($value);

mysql_query("INSERT INTO table (column, column2) VALUES ('{$escaped_value}', "0")");

```

When I check the data in the database it looks the same way as in $value so `"It's Time"` and not `"It\'s Time"`. Is this normal? Shouldn't this add a slash before the quotes?