note 87951 deleted from security.database.sql-injection by danbrown

Note Submitter: Pyornide ---- mysql_real_escape_string() is a complete joke and anyone who uses it is just begging for SQL injection. This problem was definitively solved years ago, but it continues to pop up amongst PHP amateurs who learn everything they know from other PHP amateurs. If you have to do extra work for every single variable you stick into every single query, you are GOING to forget once, and then it was all for nothing. It's really pathetic. Use prepared statements and you should never have problems with SQL injection. It creates secure code that is far more easily read and modified. You won't even have to validate that an id is an integer or whatever. Look into MySQLi. People are imperfect, and having to needlessly wrap every single datum in an ugly function call is asking for trouble. There is no reason to leave yourself open for mistakes when you can prevent them entirely.