I meant that if you were to &quot;sanitize&quot; all input your program gets by replacing &quot;&#x27;&quot; by &quot;\&#x27;&quot; in there everywhere, then assuming that most of the rest of your program actually works as normal and calls libraries that do things correctly etc, you&#x27;re just going to have backslashes show up because they&#x27;re in the string. Maybe you also echo the string back to HTML immediately before it ever goes into SQL, et cetera.<p>Only escaping quotes that are inserted directly into SQL query strings is not what I understood by &quot;sanitizing all input&quot;.