php - Want to replace certain words using preg_replace

Solution:

Please don't do that !

Use prepared statements and parameterized queries using mysqli or PDO

How can I prevent SQL injection in PHP?

Solution:

This is the dangerest thing ever, I don't want to have written this:

<?php

$test="we will ' hack your db";
$test2=" ' OR SANITIZE";

$where='`$test` = \'1\' and `$test2` = \'2\'';

$where=preg_replace('/(\$[^ `]+)/e','mysql_real_escape_string($1)',$where);

echo($where);

?>
Copy code

This is dangerous not only because of mysql_real_escape_string, but also because of preg_replace with the /e (execute) flag. It is just to see if and how it can be done.

If you have to learn anyway, please do learn prepared statements instead.