note 87951 added to security.database.sql-injection

mysql_real_escape_string() is a complete joke and anyone who uses it is just begging for SQL injection. This problem was definitively solved years ago, but it continues to pop up amongst PHP amateurs who learn everything they know from other PHP amateurs. If you have to do extra work for every single variable you stick into every single query, you are GOING to forget once, and then it was all for nothing. It's really pathetic. Use prepared statements and you should never have problems with SQL injection. It creates secure code that is far more easily read and modified. You won't even have to validate that an id is an integer or whatever. Look into MySQLi. People are imperfect, and having to needlessly wrap every single datum in an ugly function call is asking for trouble. There is no reason to leave yourself open for mistakes when you can prevent them entirely. ---- Server IP: 64.71.164.2 Probable Submitter: 68.173.205.18 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/87951 Del: integrated -- https://master.php.net/note/delete/87951/integrated Del: useless -- https://master.php.net/note/delete/87951/useless Del: bad code -- https://master.php.net/note/delete/87951/bad+code Del: spam -- https://master.php.net/note/delete/87951/spam Del: non-english -- https://master.php.net/note/delete/87951/non-english Del: in docs -- https://master.php.net/note/delete/87951/in+docs Del: other reasons-- https://master.php.net/note/delete/87951 Reject -- https://master.php.net/note/reject/87951 Search -- https://master.php.net/manage/user-notes.php