Question

Until now i’ve been using prepared statements together with real_escape_string when handling input from HTML forms. Example:

$var1 = $dbconnection->real_escape_string($_POST['varFromForm']); 

if ($insert = $dbconnection->prepare("INSERT etc.. ")) {
    $insert->bind_param('s', $var1);
    and so on..

Although, this messed up the formatting when displaying the stored data by outputting \r\n when new line breaks were used in the textarea of input. This because of it apparently escaped the input twice.

So i want to make sure that i haven’t misunderstood the deal with prepared statements and that this following code IS safe from SQL-injections by using prepared statements without the escaping?

$var1 = $_POST['varFromForm'];

if ($insert = $dbconnection->prepare("INSERT etc.. ")) {
    $insert->bind_param('s', $var1);
    and so on..

Answer 1

The sql query execution plan of a prepared statement can’t be changed by the parameters, the parameters only can be inserted. So you don’t need to escape variables.