0

how can I protect this code from sql injection?

$sql = "SELECT ID FROM newidea WHERE tag LIKE '%" . $arrayuser[$i] . "%' AND ID > $number";
$result = $conn->query($sql);
if(mysqli_num_rows($result))
$row = $result->fetch_assoc();
Wawi Sobota
  • 3
  • 4
  • If you are only starting to learn PHP then you should learn PDO instead of mysqli. PDO is much easier and more suitable for beginners. Start here https://phpdelusions.net/pdo & https://websitebeaver.com/php-pdo-prepared-statements-to-prevent-sql-injection – Dharman Apr 04 '21 at 20:01
  • Hi @Dharman , I used mysqli_real_escape_string() function. Do you think it's enough to protect from sql injection? I found different opinions in the Internet. I'll learn PDO, but for now I've done my project in mysql, so I'd like to end it. – Wawi Sobota Apr 04 '21 at 20:13
  • Technically, it should be enough but it is not worth it. Just use prepared statements and forgot about any need to escape. It's safer, easier and quicker. – Dharman Apr 04 '21 at 20:36

0 Answers0