note 111997 added to function.filter-input

I believe "travismowen" is wrong (RAW data = SQL injection ?!) ! You must "filter" any input data (GET, POST, COOKIE, ...). mysqli->real_escape_string is a pain as you need to open a DB connection. Therefore I would recommend the following to create a SQL query either use : <?php mysqli->real_escape_string(string $var|$_INPUT); ?> http://www.php.net/manual/en/mysqli.real-escape-string.php Or : <?php mysqli->prepare(string $var); & mysqli_stmt->bind('i|d|s|b',mixed &$vars...) ?> http://php.net/manual/en/mysqli.prepare.php And to use in PHP (especially when writing files) filter-input seems enough... Another good practice is to disable server HTML feed-back on errors. <?php ini_set('display_errors',(GET DEVELOPPER IP OR SOME KIND OF CREDENTIALS TO BE TRUE?'On':'Off')); ?> http://php.net/manual/en/function.ini-set.php You may also apply such filter on the server side (eg. mod_ext_filter). If you manage the server(s) on which your script(s) will be installed. ---- Server IP: 69.147.83.199 Probable Submitter: 88.207.220.168 ---- Manual Page -- http://php.net/manual/en/function.filter-input.php Edit -- https://master.php.net/note/edit/111997 Del: integrated -- https://master.php.net/note/delete/111997/integrated Del: useless -- https://master.php.net/note/delete/111997/useless Del: bad code -- https://master.php.net/note/delete/111997/bad+code Del: spam -- https://master.php.net/note/delete/111997/spam Del: non-english -- https://master.php.net/note/delete/111997/non-english Del: in docs -- https://master.php.net/note/delete/111997/in+docs Del: other reasons-- https://master.php.net/note/delete/111997 Reject -- https://master.php.net/note/reject/111997 Search -- https://master.php.net/manage/user-notes.php