The " ?, ?, ?, ? " works but not " ' " with " charset=UTF-8 ", why ?

[TigerC10]

Because the ' character is a terminating character for SQL. It's a form of attack on a website known as "SQL Injection". If you allow the character by itself it can stop the SQL sequence early, then allowing you to execute a different sql statement.

Consider this filename...

'; DELETE * FROM *;.jpg

While this is an illegal windows file name, linux does not care. If someone uploaded a file name like that, the first ' symbol would stop the SQL, then it would execute the next SQL in line (DELETE * FROM *;). So the way you prevent the injection from happening is called "escaping". You "escape" the ' character with a backslash like you saw... O\'Clock. Doing that will prevent the ' character from terminating the SQL sequence early.

Normally, the backslash is not shown. The PHP doesn't show escape characters when they're being used. However, if your PHP is using the quote symbol instead of the apostraphy, then it wouldn't see the backslash as an escape character.