Editing String literal (section)

===Nested escaping===
When code in one programming language is embedded inside another, embedded strings may require multiple levels of escaping. This is particularly common in regular expressions and SQL query within other languages, or other languages inside shell scripts. This double-escaping is often difficult to read and author.

Incorrect quoting of nested strings can present a security vulnerability. Use of untrusted data, as in data fields of an SQL query, should use [[prepared statement]]s to prevent a [[code injection]] attack. In [[PHP]] 2 through 5.3, there was a feature called [[magic quotes]] which automatically escaped strings (for convenience and security), but due to problems was removed from version 5.4 onward.