Question

Possible Duplicate:
Are dynamic mysql queries with sql escaping just as secure as prepared statements?

Is using only mysqli_real_escape_string enough to secure a query? Or is there more to consider when trying to securely query a database?

Answer 1

If used everywhere correctly real_escape_string is an option. But consider the following code:

$page = $_GET['page'];
$sql = 'SELECT `name` FROM `user` WHERE `id` = ' . mysqli_real_escape_string($page);

Safe or not? real_escape_string can only be used to escape strings inside quotation marks. $page could be 1 OR id IN (2,3,4,5,6,7,8,9) → no quotation marks, no real escaping. Casting to the correct datatype (int) might help in this case. You’re better off using prepared statements, they are not as easily to mis-use.