在进行INSERT之前，在JSON编码之前，还是在JSON编码之后，你是MySQL真正的转义数据吗？

Before inserting JSON-encoded data in MySQL, do you first JSON encode the data and then escape it prior to inserting, or do you first escape the data before JSON encoding it and then insert it?

First JSON encode it then escape it prior to inserting in the database.

The very statement of question is wrong.

1. Do not store JSON in database.
2. real escape doesn't make your data safe, as it's implied in your question.
3. mysql-real-escape-string belongs to mysql - so, the answer is quite obvious.

Don't use mysql_real_escape_string - it's deprecated. http://php.net/manual/en/function.mysql-real-escape-string.php If you use one of the DB libraries such as PDO, then that will do the work for you. See real escape string and PDO