how to search a name that include apostrophe in SQL [duplicate] - php

Question

This question already has answers here:
How can I prevent SQL injection in PHP?
(27 answers)
Closed 4 years ago.
i want to search a title that include apostrophe in it.
i call the title from variable.
for example:
$mytitle = "Daddy's Home";
then i try to search it.
$apostrophe = $val;
$replacementsapostrophe = [
"'" => "''",
];
$newval = strtr($apostrophe, $replacementsapostrophe);
$query2 = $db->prepare ("SELECT category, id_master_post, master_post_name FROM `master_post` WHERE master_post_name = '$newval'");
$query2->execute();
$value2 = $query2->fetch();
Error given
Fatal error: Uncaught PDOException: SQLSTATE[42000]: Syntax error or
access violation: 1064 You have an error in your SQL syntax; check the
manual that corresponds to your MariaDB server version for the right
syntax to use near 's Home 2'' at line 1 in
C:\xampp\htdocs\piratefiles\list.php:31 Stack trace: #0
C:\xampp\htdocs\piratefiles\list.php(31): PDOStatement->execute() #1
{main} thrown in C:\xampp\htdocs\piratefiles\list.php on line 31
im already try '%''%' still not working.

Answer 1

You should use prepared statements to avoid sql injection but to answer your question . An example;
try{
$db=new PDO(DSN,USER,PASS);
}catch(PDOException $e){
echo "couldn't connect cos of $e";
}
$sqlQuery = "SELECT category, id_master_post, master_post_name FROM `master_post` WHERE master_post_name = ? "
$prepared= $db->prepare($sqlQuery);
$prepared->execute($myTitle);
$resultObject = $prepared->fetchObject() ;