Question

I’m using prepared statements and MySQLi with my queries to protect against injection attacks. Would prepared statements remove the need for mysql_real_escape_string entirely? Is there anything else I should consider when securing my site?

Answer 1

As long as you’re using the prepared statements correctly they will. You have to make sure you’re binding all the external variables and not putting them directly in the query.

For example

$stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=" . $name);

This statement is being prepared, but it doesn’t use one of the bind methods so it does no good. It is still vulnerable to SQL injection.

To fix that make sure to bind everything…

$stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=?")) {
$stmt->bind_param("s", $city);