Question

I have a json object I want to store in my db:

$string='{"test": [{"name":"dave","user":"dan"}]}';
  $encoded=json_encode($string);

  $connection=Database::getInstance();
  $escaped=mysqli_real_escape_string($connection->connection,$encoded);
  $q="UPDATE table SET column=?";

  $s=mysqli_prepare($conn->connection,$query);
  mysqli_stmt_bind_param($s,'s',$escaped);
  mysqli_stmt_execute($s);

When I json_encode and mysqli_real_escape_string, it appears as the following in my db:

  \"{\\\"test\\\": [{\\\"name\\\":\\\"dave\\\",\\\"user\\\":\\\"dan\\\"}]}\"

Obviously, I don’t want to invite hackers but it seems like a crazy amount of slashes…do I need to do BOTH json_encode or mysqli_real_escape_string or can I just use json_encode?

Answer 1

You are already using a parametrized query – mysqli_real_escape_string() is not necessary in that case any more. (In fact, it is wrong because it breaks the data.)