Question

If I’m using prepare statements in mySQLi, would I still need to escape or check user input in any way. So for example if I had the code:

$members = new mysqli("localhost", "user", "pass", "members");
$r_email = $_POST['r_email'];
$check = $members->prepare("select user_id from users where email = ?");
$check->bind_param('s', $r_email);
$check->execute();
$check->store_result();
if ($check->num_rows > 0) {
    echo "user already registered";
    $check->close();
}
$members->close();

Would I need to change $r_email = $_POST['r_email'] to $r_email = mysql_real_escape_string($_POST['r_email']);

Thanks.

Answer 1

It’s not necessary to escape a value if you’re going to pass as a parameter. In fact, you should not, because you’ll insert literal backslashes into your data.

These must be part of the SQL query at prepare time, so the RDBMS can parse and validate them. or validate user input at form.

Always SQL-Escape data that you put in SQL sentences. Never SQL-Escape data outside SQL sentences.