Question

I have a quick question about mysql_real_escape_string. Where should I use it?

I have a *.php file with form that is redirecting it to itself, but that file is using another file that has class in it with function Add(params);

So should I escape strings when they are submitted?

$catName = mysql_real_escape_string($_POST['edtCatAddName']);

Or should I escape strings in my class?

$catName = mysql_real_escape_string($catName);

Or perhaps both these situations are wrong and I need to do something else? I’ve tried to escape just my query like this

$query = mysql_real_escape_string("INSERT INTO cat (catName, catDescr, catImg, catSubLevel, catSubID) VALUES ('$catName', '$catDescr', '$catImgURL', $catSubLevel, $catSubID)");

But it’s not too good because this way my query won’t go since catName and some other variables are string type and I need to add ‘ before and after them and these chars are escaped.

Any advice? I’m very new to this…

So if I use PDO then all I have to do is

$STH = $DBH->prepare("my raw, not escaped query");  
$STH->execute(); 

and I can feel secure?

Answer 1

nowhere, you should use PDO prepared statements instead to protect you against SQL-injections.