Question

I am setting up a couple of MySQLi multi_query function. I know you can’t use prepared statements with multi_query, so I wanted to know what security precautions is recommended to use with muti_query.

real_escape_string()?

Answer 1

Pretty much yes. Especially given, that multi_query() allows for ‘exploits of a mum‘ type of injection. So yeah:

1. Escape strings
2. Cast inetgers to integers and floats to floats
3. If possible, assign your application privileges to SELECT, UPDATE, INSERT and DELETE only.