title: mysql_real_escape_string Not Working with '
body: <p>I have a form processed with PHP. It contains a field for Notes about the client job.
  The problem is that if there is a ' within in the notes - such as it's, O'Reilly, that's etc, it escapes the string in the database, so I have all of the notes up until it encounters the ' then that's the end of the notes.</p>
  
  <p>I realise there are things like mysqli_ and PDO, but it's the busy season at the moment and I could just do with quickly fixing this before doing a complete update/overhaul in January.</p>
  
  <p>Any idea why it isn't working? Code included. It doesn't matter where I put the mysql_real_escape_string(), it doesn't work anywhere.</p>
  
  <p>FYI: The table column is TEXT. And there are a couple of other fields hence the foreach</p>
  
  <pre><code>// SELECTS AND CONNECTS TO SERVER/DB
  include_once('config/db.inc.php');
  
  
  // CONVERT ALL $_POST['name'] to $name and clean/prep for mysql insertion
  foreach($_POST as $key =&gt; $value ) {    
         $$key = mysql_real_escape_string($value); 
         }
  
  
  // UPDATE CLIENT JOB NOTES
  $query = "UPDATE client_list SET bookingNotes='$bookingNotes' WHERE id='$CID'";
           mysql_query($query, $conn) or die(mysql_error());
  </code></pre>
  
  <p>TIA</p>
  
  <p><strong>Edit for the responses below:</strong></p>
  
  <p>$bookingNotes and $CID are define by the form variables $_POST['bookingNotes'] and $_POST['CID'] where the foreach essentially removes the "_POST" part. (that's the whole $$key = $value part)</p>
  
  <p>As mentioned, I appreciate mysqli_ and PDO but am currently unable to learn, update and implement those system wide at the moment. This runs locally and my current version of PHP 5.4.1 supports the function. I understand PDO is better, but for now that is not an option so please don't belittle me with "do it properly" or "learn how to code". That isn't the issue at hand.</p>
  
  <p>I know what's happening and where and why - mysql is treating the ' as and end of the string. But I don't know why it's happening when I believe the function should escape the ' and allow it into the database.</p>
  
  <p>To surmise, this is what happens.</p>
  
  <p>"Today is very grey and it's raining" is entered into the form as $bookingNotes. The script then inputs that into the TEXT column of the database. But what appears in the database is;</p>
  
  <p>"Today is very grey and it"</p>
  
  <p>TIA and Thanks for the responses so far.</p>