Question

If I’m using mysql_real_escape_string and addslashes to avoid sql Injection attack in my website is this two are enough to stop SQL Injection so its 100% sure no one can now attack using SQL Injection?

Answer 1

It depends on your query; if you are talking about just the values you want to insert in your database, mysql_real_escape_string is enough, you don´t need addslashes.

If you also are talking about variable table or column names, you’ll need white-lists as well as mysql_real_escape_string will not prevent sql injection on these.

So the answer really is: No, it depends on your query.