Use of pg_escape_string()

[Sylvain Racine <syracine(at)sympatico(dot)ca>]

Hello,

I use to hear about to escape every variables who come from user in PHP. 
Most programmers around me use MySQL with mysql_escape_string(). Because 
I program with PostgreSQL, I take advantage to use pg_escape_string(). 
Everything goes well, up I entered data with apostrophe('). 
pg_escape_string() escapes my apostrophe with another apostrophe (''). 
My data are well store in database. No error... except that appears a 
double apostrophe. This is not what I want.

Maybe something is wrong in my program. Here is a sample of what I use 
to store data in table "personnes" which have two columns: firstname, 
lastname. I remove database connection and construction of objects 
Minute and Personnes.

Ex: Nathalie Prud'homme gives Nathalie Prud''homme...

$minute->personnes->firstname = $_POST["firstname"];
$minute->personnes->lastname = $_POST["lastname"];
$fields = array("firstname","lastname");

$query = 
$GLOBALS['phpag']->db->record('personnes',$fields,$minute->personnes);
if (!$GLOBALS['phpag']->db->query($query))
{
     echo $GLOBALS['phpag']->db->error;
}



class db

{
function query($query, $offset=0, $num_rows=-1)
{
   if (!$this->link_ID)
   {
       $this->error .= '<div style="color:#FF0000">Can't connect to 
database.</div>';
           return FALSE;
   }
     $this->record = array();
   $this->count = 0;

   if (!$num_rows && $this->debug)
   { 
       print 'number of lines limit =  
'.$GLOBALS['phpag_info']['preferences']['phpag']['lines'];
       $num_rows = $GLOBALS['phpag_info']['preferences']['phpag']['lines'];
   }
   if ($num_rows > 0)
   {   
       $query .= ' LIMIT '.$num_rows.' OFFSET '.$offset;
       if ($this->debug) {
             print '<div>Query: '.$query.'</div>';
         }

       $this->query_ID = pg_query($this->link_ID, $query);
   } else
   {
       if ($this->debug) {
             print '<div>Query: '.$query.'</div>';
         }

       $this->query_ID = pg_query($this->link_ID, $query);
   }
  
     if (!$this->query_ID)
     {
       $this->err = pg_last_error($this->link_ID);
       $this->error .= '<div style="color:#FF0000">Error in query sent 
to database<br><br>'.$this->err."<br><br>\n";
       $this->error .= "<u>Invalid SQL query:</u>: 
<blockquote>$query</blockquote></div><br>";
       return FALSE;
     }
     else
     {
       for ($i = 0; $i < pg_numrows($this->query_ID); $i++)
       {
           $this->record[$i] = pg_fetch_array($this->query_ID,$i);
      
           if ($this->debug)
           {
               echo 'Record #'.$i.' ';
               print_r($this->record[$i]);
               print "<br>";
           }
       }
       //Calculate how many records
       $this->count = ($this->record ? count($this->record): 0);
     }

     return $this->query_ID;
}

// Escape string if necessary
function slash ($text)
{
   $text = pg_escape_string($text);
     return $text;
}


       function record($table,$fields,$values)
       {
             if (class_exists(get_class($values)))
                 $values=get_object_vars($values);
                       $query = 'INSERT INTO '.$table.'(';
                      
                       if (empty($champs)) {
                            $arg['type'] = 'php';
                          $arg['message'] = '<div 
style="color:#FF0000">SQL Error: You try to insert values in table 
without declare column name!</div>';
                          Error::thrown($arg,FALSE,TRUE);
                       }
                       foreach ($fields as $num =>$col) {
                         $query .= ($num ? ',': '').$col;
             }
          
             $query .= ') VALUES (';
          
             if (empty($values)) {
                       $arg['type'] = 'php';
                       $arg['message'] = '<div 
style="color:#FF0000">SQL  Error: You try to insert data in table 
without giving values!</div>';
                       Error::thrown($arg,FALSE,TRUE);
             }

               $valueClause = '';
               $id = 0;
               foreach ($values as $num => $col) {
                 preg_match('/^id/',$num,$match);
                 if (!empty($match[0])) $id += 1;
                 if (empty($match[0])) { // Remove column beginning 
with 'id...'
                   $valueClause .= ($valueClause ? ',' : 
'').'\''.$this->slash($col).'\'';
                 }
             }
        
             if (count($fields) != (count($fields) - $id)) {
                       $arg['type'] = 'php';
                       $arg['message'] = '<div 
style="color:#FF0000">SQL Error: The number of columns mismatches with 
the number of values!</div>';
                       Error::thrown($arg,FALSE,TRUE);
             }  
          
             $query .= $valueClause.');';
            
             return $query;
       }

}


Anybody have an idea?