note 68795 added to function.mysqli-prepare

The purpose of prepared statements is to not include data in your SQL statements. Including them in your SQL statements is NOT safe. Always use prepared statements. They are cleaner to use (code easier to read) and not prone to SQL injections. Escaping strings to include in SQL statements doesn't work very well in some locales hence it is not safe. ---- Server IP: 66.163.161.117 Probable Submitter: 216.55.199.131 (proxied: unknown) ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.mysqli-prepare.php Edit -- https://master.php.net/note/edit/68795 Del: integrated -- https://master.php.net/note/delete/68795/integrated Del: useless -- https://master.php.net/note/delete/68795/useless Del: bad code -- https://master.php.net/note/delete/68795/bad+code Del: spam -- https://master.php.net/note/delete/68795/spam Del: non-english -- https://master.php.net/note/delete/68795/non-english Del: in docs -- https://master.php.net/note/delete/68795/in+docs Del: other reasons-- https://master.php.net/note/delete/68795 Reject -- https://master.php.net/note/reject/68795 Search -- https://master.php.net/manage/user-notes.php