Question

Normally I do this for all my user inputs both strings and numerical inputs:

$matric_no = mysql_real_escape_string ($_POST['matric_no']);

And I use the parameter on the LHS to get the required value either to work on or post into mysql. Is this practice enough security wise? Is it a good practice?

Thanks for your help..

Answer 1

As long as all of your variables being inserted into the query are enclosed in quotes and escaped using mysql_real_escape_string(), you should be okay.

If possible, I recommend using the Mysqli extension instead of the obsolete Mysql extension. If you do, then you can make use of parameter binding, and be 100% sure that your queries are safe from injection (as long as you bind all parameters, that is).