SQL Injection protection

[jbis2k]

Is the PHP function

mysql_real_escape_string($string); 
[\code]
sufficient to prevent all injection attempts? Do I need to consider other functions as well?

[gizmola]

It depends on the code.  mysql_real_escape_string is not designed to prevent injections although in some cases it does.  It is designed to escape quotes.  You need to consider the input type of each variable. For example, if you are accepting an integer value, then you should use:

 

$i = (int)$_GET['i'];

 

Alternatively, using PDO or mysqli with bind variables is an excellent one step solution for preventing SQL injections.

[jbis2k]

Thanks much