MySQL Insert un-trusted data

Question

I see a lot of post about inserting into MySQL database. The vast amount of them seem to forget that its user input we are dealing with. What would be the best was to insert data in to the table. Would mysqli_real_escape_string be okay? Or would using prepared statements be a better option, maybe both?

Escaping is not okay. Using both even less. Use Prepared, parameterized Queries. — Charlotte Dunois, Jul 26 '16 at 10:32

score 0 · Accepted Answer · edited Jul 26 '16 at 10:29

0

mysqli_real_escape_string is good, but not always safe as prepared statement.

mysql_real_escape_string() prone to the same kind of issues affecting addslashes().

So use of prepared statement is much better.

edited Jul 26 '16 at 10:29

Nana Partykar

10,556
10
48
77

answered Jul 26 '16 at 10:27

Devsi Odedra

5,244
1
23
37

MySQL Insert un-trusted data

1 Answers1