Question

Am trying to making a specific query as follow

$query = "SELECT * FROM users WHERE uid IN (1,10,50,60,94,102)";

how can i use a mysql escape string for where clause or if i just use it like that, is it ok?

Answer 1

The way you are doing now is not an UPDATE query. You are only retrieving records from the database. In order to update records from the database, you need to use the UPDATE DML. The syntax for that is

UPDATE tableName
SET columnName = newValue
WHERE columnN = value            // <== this is your condition

Returning back to your question, the way you are doing the query doesn’t need mysql_escape_string because you are only passing integer values. Currently, more PHP developers are not using mysql_escape_string anymore because it’s already been discourage and as the PHP Manual site says this function is already depreciated. Alternatively, PDO_MYSQL or MYSQLi extensions should be used instead.