escaping needed with select

[rubing]

I use the improved mysql functions to escape my data prior to insertion (e.g. mysqli_real_escape_string), so a subtle question arises.

 

Do I query as follows:

 

$query="SELECT cola FROM table.a WHERE colb='$var'";
$conn->query($query);

 

Or like this:

$var = $mysqli->real_escape_string($var);
$query="SELECT cola FROM table.a WHERE colb='$var'";
$conn->query($query);

 

[zq29]

You should escape $var before running it as part of a query, assuming it is user input.