php - using mysql_real_escape_string to cleans my queries -
Is this the best way to do this? Should I do it in every query in every value? addlashes (mysql_real_escape_string ()) overkill? text"> If you are using mysql_query () then yes, Mysql_real_escape_string () is the best way. And of course, you have to implement it in each parameter that you mix in your SQL statement. E.g. $ query = "Select from x, y, z foo Where A = '". Mysql_real_escape_string ($ _ POST ['A'], $ mysql) "'And B ='" Mysql_real_escape_string ($ _ POST ['B'], $ mysql) "'"; But you can also use the statement made, e.g. With the module, the parameters are transferred in addition to the SQL statement and therefore they do not need to be avoided. It is more secure (because you can not forget to avoid or incorrectly misrepresented it), it is often faster and easier to compare than to mixing parameters in the statement. $ pdo = new PDO ('mysql: host = localhost; dbname = test', ...