title: PHP: Prepared Statements cannot escape from single quotes
body: <p>I'm inserting value to MySql for sign up. Because of the 'single quotes' problem, i worked with prepared statements. Normally i was using addslashes but it doesnt work with all sql query, works only specific row. Let me explain :</p>
  
  <p>It's simple sign up activity. </p>
  
  <p>Android side of my code :</p>
  
  <pre><code> final String email=_email.getText().toString();
          final String password=_password.getText().toString();
  
          final String sqlcode ="Insert into login (email,password) VALUES ('"+email+"','"+password+"')";
          final String sqllogin="SELECT email FROM login WHERE email= '"+email+"'";
  
  @Override
              protected Map&lt;String, String&gt; getParams() {
                  Map&lt;String,String&gt; params=new HashMap&lt;&gt;();
                  params.put("sqllogin",sqllogin);
                  params.put(getString(R.string.sqlcode),sqlcode);
                  return params;
              }
  </code></pre>
  
  <p>PHP side of my code :</p>
  
  <pre><code>&lt;?php
  
  if ($_SERVER['REQUEST_METHOD'] =='POST'){
  
      $sqllogin = $_POST["sqllogin"];
      $sqlcode= $_POST["sqlcode"];
  
      require_once 'connect.php';
  
      mysqli_query($conn,"SET NAMES 'utf8'");
  
      $stmtcheck = $conn-&gt;prepare($sqllogin);
      $stmtcheck-&gt;execute();
      $stmtcheck-&gt;store_result();
  
        if ( $stmtcheck-&gt;num_rows &gt;0) { // if email exists
        $result["message"] = "duplicate";
  
          echo json_encode($result);
          mysqli_close($conn);
          $stmtcheck-&gt;close();
        }
        else //if email !exists create one
        { 
          $stmtcheck-&gt;close();
          $stmtadd = $conn-&gt;prepare($sqlcode);
  
          if ($stmtadd-&gt;execute()) { 
              // it worked
              $result["message"] = "success";
              echo json_encode($result);
              mysqli_close($conn);
              $stmtadd-&gt;close();
           } else {
              // it didn't
              $result["message"] = "error";
              echo json_encode($result);
              mysqli_close($conn);
              $stmtadd-&gt;close();
           }
     }
  }
  
  ?&gt;
  </code></pre>
  
  <p>I work with prepared statements completely as you see. But i dont understand why single quotes not inserting to the database.
  The more strange thing is : I can insert double quotes. </p>