[Nin9r]

How to escape a string corectly?

HTML Code:

mysql_real_escape_string(aString, aString);
	format(szMessage, sizeof(szMessage), "INSERT INTO punsishes (text, playerID) VALUES ('%s', '%d')", aString,PlayerVar[playerid][pInternalID]);
	mysql_tquery(handle,szMessage);

or

HTML Code:

	format(szMessage, sizeof(szMessage), "INSERT INTO punsishes (text, playerID) VALUES ('%s', '%d')", aString,PlayerVar[playerid][pInternalID]);
mysql_real_escape_string(szMessage, szMessage);
	mysql_tquery(handle,szMessage);