don't call escape_string_for_mysql() unnecesary don't overwrite local buffer escape_string_for_mysql(): take a length of the destination buffer as an argument