note 106564 added to security.database.sql-injection

The best way has got to be parameterised queries. Then it doesn't matter what the user types in the data goes to the database as a value. A quick search online shows some possibilities in PHP which is great! Even on this site - http://php.net/manual/en/pdo.prepared-statements.php which also gives the reasons this is good both for security and performance. ---- Server IP: 69.147.83.197 Probable Submitter: 81.159.172.15 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/106564 Del: integrated -- https://master.php.net/note/delete/106564/integrated Del: useless -- https://master.php.net/note/delete/106564/useless Del: bad code -- https://master.php.net/note/delete/106564/bad+code Del: spam -- https://master.php.net/note/delete/106564/spam Del: non-english -- https://master.php.net/note/delete/106564/non-english Del: in docs -- https://master.php.net/note/delete/106564/in+docs Del: other reasons-- https://master.php.net/note/delete/106564 Reject -- https://master.php.net/note/reject/106564 Search -- https://master.php.net/manage/user-notes.php