note 124822 added to mysqli.examples-basic

Concatenating variables directly into a SQL statement is a huge anti-pattern that is likely to introduce a SQL injection exploit. MySQLi includes prepared statements, which allow you to safely pass variable data to a SQL query: https://www.php.net/manual/en/mysqli.prepare.php For more information on SQL Injection exploits please consult OWASP: https://owasp.org/www-community/attacks/SQL_Injection ---- Server IP: 45.112.84.4 Probable Submitter: 38.142.137.34 (proxied: 71.218.134.246) ---- Manual Page -- http://php.net/manual/en/mysqli.examples-basic.php Edit -- https://master.php.net/note/edit/124822 Del: integrated -- https://master.php.net/note/delete/124822/integrated Del: useless -- https://master.php.net/note/delete/124822/useless Del: bad code -- https://master.php.net/note/delete/124822/bad+code Del: spam -- https://master.php.net/note/delete/124822/spam Del: non-english -- https://master.php.net/note/delete/124822/non-english Del: in docs -- https://master.php.net/note/delete/124822/in+docs Del: other reasons-- https://master.php.net/note/delete/124822 Reject -- https://master.php.net/note/reject/124822 Search -- https://master.php.net/manage/user-notes.php