Binding params and escaping string in MySQLi (PHP)

Question

I bind all variables to all kind of statements (UPDATE/INSERT/SELECT etc.) using the bind_param() function. But I am confused with bind params.

Do I also need to use real_escape_string even though I use bind_param? Are both of them completely different things?

webbiedave · Accepted Answer · 2011-01-26 16:33:57Z

6

No you don't need to escape them. Binding params eliminates the need for escaping by removing the dangers of string concatenation.

With binding, you're essentially telling MySQL to use the contents of this variable as the value for this field.

answered Jan 26, 2011 at 16:33

webbiedave

49k8 gold badges92 silver badges104 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Binding params and escaping string in MySQLi (PHP)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related