Question

I know this is a very basic question, thats why I just want a simple answer please, there is several ways to my user input safe for mysql.

Is using this the BEST method

mysql_real_escape_string()

On all user submitted items going into a mysql query?

If I use the above, do I need to use another function on that date when I get it back from mysql to show on a PHP page?

Answer 1

PHP has a very good filter Function

http://php.net/manual/de/ref.filter.php

/*** use a callback filter to mysql_real_escape_string ***/
$answer = filter_input(INPUT_POST, "answer", FILTER_CALLBACK, array("options"=>"mysql_real_escape_string"));

/*** create an sql query ***/
$sql = "INSERT INTO quiz (answers) VALUES ('{$answer}')";

/*** echo the query ***/
echo $sql;