Question

I have a mysql query like following

mysql_query("select * from user where name='$name' LIMIT 1");

If suppose my input from client side is ‘John’ there will be MySQL error in my query.
What is the best practice of preventing this?

Answer 1

At first, mysql_* functions are deprecated and you should use PDO or mysqli_ instead. This two libraries implements prepared Statements which automatically escape your input.

If you want to use mysql_* instead, you have to call mysql_real_escape_string to the passed var

mysql_query("select * from user where name='" . mysql_real_escape_string($name) . "' LIMIT 1");