mysqli_escape_string vs. mysqli_prepare
| From: | aRZed | Date: | Sat, 21 Aug 2004 11:15:20 +0000 |
| Subject: | mysqli_escape_string vs. mysqli_prepare | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-194389@lists.php.net to get a copy of this message | ||
Hy!
I have a relative simple question about mysqli_prepare:
When I prepare a statement and then bind parameters to it, does php automatically care for escaping strings etc.?
Example:
--------
<?php
$stmt = $mysqli->prepare("SELECT FROM table WHERE x=?");
$p = "5'"
$stmt->bind_param("i",$p);
# is "5'" converted to 5 like it would when i use intval($p)?
$stmt->reset();
$s = "'xyz' || x LIKE '%'";
$stmt->bind_param("s",$s);
# will those "'" be escaped?
?>
thanks for help