Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

7
  • 7
    Mysqli prepared statements If you're accepting user data, do not use anything else. Period. Commented Nov 3, 2014 at 19:45
  • 1
    It's perfectly safe, but it's best if you use prepared statements. Then you can just simply forget about escaping the data. Commented Nov 3, 2014 at 19:46
  • 1
    Ohgodwhy: How would the injection attack work in this case? What would be an example of bad input? Commented Nov 3, 2014 at 19:46
  • Example here. Do not use mysqli_real_escape_string to protect against SQL injection. stackoverflow.com/questions/5741187/… Commented Nov 3, 2014 at 19:48
  • @user4819 Just have a look at the thread that was linked by Svein for an example. There are other examples on the web as well. It is not an end all to be all protection measure, and it should not be purported as such. Commented Nov 3, 2014 at 19:50