PHP Mysqli - Parameter binding AND escape_string?

Question

For database security do I need to do BOTH binding parameters in a prepared statement AND mysql_real_escape_string() on the input?

Thanks!

No! Bind parameters automatically escape quotes in strings, that's their purpose: so don't do it yourself unless you want erroneous escape characters in the saved values — Mark Baker
– Mark Baker, Commented Mar 4, 2013 at 23:44

bobince · Accepted Answer · 2013-03-05 00:47:20Z

1

No, parameterised queries are fine on their own. As long as you keep all variable data in parameters, passed separately from the query, they can be picked up without any escape/unescape handling.

You shouldn't blanket-escape at the input phase in general - you don't know what kinds of escape (SQL, HTML, JS, ...) you're going to need until the point you actually inject a value into one of those string contexts. Applying all kinds of escapes over all input data will only lead to mangled and inconsistent input handling.

answered Mar 5, 2013 at 0:47

bobince

538k111 gold badges675 silver badges846 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP Mysqli - Parameter binding AND escape_string?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related